Cross-site scripting (XSS) vulnerability in include/top_graph_header.php in Cacti before 0.8.7g allows remote attackers to inject arbitrary web script or HTML via the graph_start parameter to graph.php. NOTE: this vulnerability exists because of an incorrect fix for CVE-2009-4032.2.b.

The remote host is affected by the vulnerability described in GLSA-201401-20 (Cacti: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Cacti. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could execute arbitrary SQL commands via specially       crafted parameters, execute arbitrary shell code or inject malicious       script code.
  Workaround :

    There is no known workaround at this time.

Several vulnerabilities have been discovered in Cacti, a graphing tool for monitoring data. Multiple cross site scripting issues allow remote attackers to inject arbitrary web script or HTML. A SQL injection vulnerability allows remote attackers to execute arbitrary SQL commands.

Several vulnerabilities have been found in cacti, a frontend to rrdtool for monitoring systems and services. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2007-3112, CVE-2007-3113     It was discovered that cacti is prone to a denial of     service via the graph_height, graph_width, graph_start     and graph_end parameters. This issue only affects the     oldstable (etch) version of cacti.

  - CVE-2009-4032     It was discovered that cacti is prone to several     cross-site scripting attacks via different vectors.

  - CVE-2009-4112     It has been discovered that cacti allows authenticated     administrator users to gain access to the host system by     executing arbitrary commands via the 'Data Input Method'     for the 'Linux - Get Memory Usage' setting.

  There is no fix for this issue at this stage. Upstream will   implement a whitelist policy to only allow certain 'safe' commands.
  For the moment, we recommend that such access is only given to   trusted users and that the options 'Data Input' and 'User   Administration' are otherwise deactivated.

ID	Name	Product	Family	Severity
72075	GLSA-201401-20 : Cacti: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
57524	Debian DSA-2384-2 : cacti - several vulnerabilities	Nessus	Debian Local Security Checks	high
44819	Debian DSA-1954-1 : cacti - insufficient input sanitising	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2010-2543

medium

Tenable Plugins

high

high

high