CVE-2009-4032
- State
- Published
- Severity
- Not scored
- Published
- Nov 27, 2009
- Updated
- Aug 7, 2024
- Reserved
- Nov 20, 2009
Description
Multiple cross-site scripting (XSS) vulnerabilities in Cacti 0.8.7e allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) graph.php, (2) include/top_graph_header.php, (3) lib/html_form.php, and (4) lib/timespan_settings.php, as demonstrated by the (a) graph_end or (b) graph_start parameters to graph.php; (c) the date1 parameter in a tree action to graph_view.php; and the (d) page_refresh and (e) default_dual_pane_width parameters to graph_settings.php.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- http://www.cacti.net/download_patches.php
- 20091126 Cacti 0.8.7e: Multiple security issuesmailing-list
- 20091125 Cacti 0.8.7e: Multiple security issuesmailing-list
- FEDORA-2009-12575vendor-advisory
- 38087third-party-advisory
- JVN#09758120third-party-advisory
- cacti-name-xss(54388)vdb-entry
- 41041third-party-advisory
- JVNDB-2009-003901third-party-advisory
- http://docs.cacti.net/#cross-site_scripting_fixes
- RHSA-2010:0635vendor-advisory
- [oss-security] 20091125 CVE Request - Cacti - 0.8.7emailing-list
- [oss-security] 20091130 Re: CVE Request - Cacti - 0.8.7emailing-list
- 37481third-party-advisory
- [oss-security] 20091125 Re: CVE Request - Cacti - 0.8.7emailing-list
- [oss-security] 20091126 Re: CVE Request - Cacti - 0.8.7emailing-list
- 37109vdb-entry
- ADV-2009-3325vdb-entry
- ADV-2010-2132vdb-entry
- 37934third-party-advisory
- 60483vdb-entry
- http://bugs.gentoo.org/show_bug.cgi?id=294573
- FEDORA-2009-12560vendor-advisory
- http://www.cacti.net/downloads/patches/0.8.7e/cross_site_fix.patch
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.