Cross-site scripting (XSS) vulnerability in utilities.php in Cacti before 0.8.7g, as used in Red Hat High Performance Computing (HPC) Solution and other products, allows remote attackers to inject arbitrary web script or HTML via the filter parameter.

The remote host is affected by the vulnerability described in GLSA-201401-20 (Cacti: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Cacti. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could execute arbitrary SQL commands via specially       crafted parameters, execute arbitrary shell code or inject malicious       script code.
  Workaround :

    There is no known workaround at this time.

According to its self-reported version number, the Cacti application running on the remote web server is prior to version 0.8.7g. It is, therefore, potentially affected by multiple cross-site scripting and HTML injection vulnerabilities. An attacker may be able to exploit these issues to inject arbitrary HTML or script code into a user's browser to be executed within the security context of the affected site.

ID	Name	Product	Family	Severity
72075	GLSA-201401-20 : Cacti: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
57617	Cacti < 0.8.7g Multiple XSS and HTML Injection Vulnerabilities	Nessus	CGI abuses : XSS	medium

Detections

Analytics

CVE-2010-2544

medium

Tenable Plugins

high

medium