# CVE-2016-10367: Opsview Monitor Pro - Path Traversal

> Live exploitation tracking for CVE-2016-10367 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2016-10367

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 7.5
- **Public exploit available:** Yes
- **Affected products:** Opsview Monitor Pro
- **Weaknesses:** CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))

## Description

In Opsview Monitor Pro (Prior to 5.1.0.162300841, prior to 5.0.2.27475, prior to 4.6.4.162391051, and 4.5.x without a certain 2016 security patch), an unauthenticated Directory Traversal vulnerability can be exploited by issuing a specially crafted HTTP GET request utilizing a simple URL encoding bypass, %252f instead of /.

## CrowdSec analysis

[CVE-2016-10367](https://euvd.enisa.europa.eu/vulnerability/CVE-2016-10367) is a directory traversal vulnerability in Opsview Monitor Pro versions prior to several 5.x and 4.x releases, allowing unauthenticated attackers to access sensitive files on the server by exploiting a URL encoding bypass. This flaw could be leveraged to read arbitrary files, potentially exposing confidential information and aiding further attacks.

CrowdSec has been tracking this vulnerability and its exploits since 10th of September 2025.

Data from the CrowdSec community indicates that exploitation of CVE-2016-10367 is highly selective and intelligence-driven. Threat actors use advanced reconnaissance and carefully choose their targets, often as part of sophisticated campaigns or advanced persistent threat operations.
Data from the CrowdSec community also indicates a gradual decrease in attacks targeting CVE-2016-10367. While still present in the wild, exploitation levels have dropped noticeably week-over-week. This may signal that the vulnerability is becoming less relevant or that defenses are improving fast enough for attackers to lose interest.

Attackers exploit this vulnerability by sending requests to URLs containing `/monitoring/..%252f..%252f` with multiple encoded directory traversal sequences to access sensitive files such as `/etc/passwd`.

## Timeline

- 2017-05-03: CVE Published. CVE-2016-10367 is published to NVD.
- 2025-09-10: Rule Released. CrowdSec releases a rule to detect CVE-2016-10367 exploitation attempts against the CrowdSec Network.
- 2025-09-11: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2016-10367 for the first time.

## References

- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-10367.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2016-10367) follows observed exploitation activity for CVE-2016-10367. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.