RHSA-2010:0635

http://cacti.net/release_notes_0_8_7g.php

[oss-security] 20100722 Cacti XSS fixes in 0.8.7g

http://svn.cacti.net/viewvc/cacti/branches/0.8.7/utilities.php?r1=6025&r2=6024&pathrev=6025

http://svn.cacti.net/viewvc?view=rev&revision=6025

https://bugzilla.redhat.com/show_bug.cgi?id=459105

42575

[oss-security] 20100726 Re: Cacti XSS fixes in 0.8.7g

41041

MDVSA-2010:160

ADV-2010-2132

cacti-utilities-xss(61226)

The remote host is affected by the vulnerability described in GLSA-201401-20 (Cacti: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Cacti. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could execute arbitrary SQL commands via specially       crafted parameters, execute arbitrary shell code or inject malicious       script code.
  Workaround :

    There is no known workaround at this time.

According to its self-reported version number, the Cacti application running on the remote web server is prior to version 0.8.7g. It is, therefore, potentially affected by multiple cross-site scripting and HTML injection vulnerabilities. An attacker may be able to exploit these issues to inject arbitrary HTML or script code into a user's browser to be executed within the security context of the affected site.

ID	Name	Product	Family	Severity
72075	GLSA-201401-20 : Cacti: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
57617	Cacti < 0.8.7g Multiple XSS and HTML Injection Vulnerabilities	Nessus	CGI abuses : XSS	medium

CVE-2010-2544

medium

Tenable Plugins

high

medium