CVE-2010-2545
published 2010-08-23CVE-2010-2545: Multiple cross-site scripting (XSS) vulnerabilities in Cacti before 0.8.7g, as used in Red Hat High Performance Computing (HPC) Solution and other products…
PriorityP419medium4.3CVSS 2.0
AVNACMAuNCNIPAN
EPSS
1.80%
76.2th percentile
Multiple cross-site scripting (XSS) vulnerabilities in Cacti before 0.8.7g, as used in Red Hat High Performance Computing (HPC) Solution and other products, allow remote attackers to inject arbitrary web script or HTML via (1) the name element in an XML template to templates_import.php; and allow remote authenticated administrators to inject arbitrary web script or HTML via vectors related to (2) cdef.php, (3) data_input.php, (4) data_queries.php, (5) data_sources.php, (6) data_templates.php, (7) gprint_presets.php, (8) graph.php, (9) graphs_new.php, (10) graphs.php, (11) graph_templates_inputs.php, (12) graph_templates_items.php, (13) graph_templates.php, (14) graph_view.php, (15) host.php, (16) host_templates.php, (17) lib/functions.php, (18) lib/html_form.php, (19) lib/html_form_template.php, (20) lib/html.php, (21) lib/html_tree.php, (22) lib/rrd.php, (23) rra.php, (24) tree.php, and (25) user_admin.php.
Affected
43 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cacti | cacti | <= 0.8.7f | — |
| cacti | cacti | — | — |
| cacti | cacti | — | — |
| cacti | cacti | — | — |
| cacti | cacti | — | — |
| cacti | cacti | — | — |
| cacti | cacti | — | — |
| cacti | cacti | — | — |
| cacti | cacti | — | — |
| cacti | cacti | — | — |
| cacti | cacti | — | — |
| cacti | cacti | — | — |
| cacti | cacti | — | — |
| cacti | cacti | — | — |
| cacti | cacti | — | — |
| cacti | cacti | — | — |
| cacti | cacti | — | — |
| cacti | cacti | — | — |
| cacti | cacti | — | — |
| cacti | cacti | — | — |
| cacti | cacti | — | — |
| cacti | cacti | — | — |
| cacti | cacti | — | — |
| cacti | cacti | — | — |
| cacti | cacti | — | — |
CVSS provenance
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
osv4.3MEDIUM
vendor_debian4.3MEDIUM
vendor_redhat4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-h4qm-pq35-233f: Multiple cross-site scripting (XSS) vulnerabilities in Cacti before 0
ghsa_unreviewed·2022-05-17
CVE-2010-2545 [MEDIUM] CWE-79 GHSA-h4qm-pq35-233f: Multiple cross-site scripting (XSS) vulnerabilities in Cacti before 0
Multiple cross-site scripting (XSS) vulnerabilities in Cacti before 0.8.7g, as used in Red Hat High Performance Computing (HPC) Solution and other products, allow remote attackers to inject arbitrary web script or HTML via (1) the name element in an XML template to templates_import.php; and allow remote authenticated administrators to inject arbitrary web script or HTML via vectors related to (2) cdef.php, (3) data_input.php, (4) data_queries.php, (5) data_sources.php, (6) data_templates.php, (7) gprint_presets.php, (8) graph.php, (9) graphs_new.php, (10) graphs.php, (11) graph_templates_inputs.php, (12) graph_templates_items.php, (13) graph_templates.php, (14) graph_view.php, (15) host.php, (16) host_templates.php, (17) lib/functions.php, (18) lib/html_form.php, (19) lib/html_form_templat
OSV
CVE-2010-2545: Multiple cross-site scripting (XSS) vulnerabilities in Cacti before 0
osv·2010-08-23·CVSS 4.3
CVE-2010-2545 [MEDIUM] CVE-2010-2545: Multiple cross-site scripting (XSS) vulnerabilities in Cacti before 0
Multiple cross-site scripting (XSS) vulnerabilities in Cacti before 0.8.7g, as used in Red Hat High Performance Computing (HPC) Solution and other products, allow remote attackers to inject arbitrary web script or HTML via (1) the name element in an XML template to templates_import.php; and allow remote authenticated administrators to inject arbitrary web script or HTML via vectors related to (2) cdef.php, (3) data_input.php, (4) data_queries.php, (5) data_sources.php, (6) data_templates.php, (7) gprint_presets.php, (8) graph.php, (9) graphs_new.php, (10) graphs.php, (11) graph_templates_inputs.php, (12) graph_templates_items.php, (13) graph_templates.php, (14) graph_view.php, (15) host.php, (16) host_templates.php, (17) lib/functions.php, (18) lib/html_form.php, (19) lib/html_form_templat
Red Hat
cacti: XSS via various object names or descriptions
vendor_redhat·2010-07-09·CVSS 4.3
CVE-2010-2545 [MEDIUM] CWE-79 cacti: XSS via various object names or descriptions
cacti: XSS via various object names or descriptions
Multiple cross-site scripting (XSS) vulnerabilities in Cacti before 0.8.7g, as used in Red Hat High Performance Computing (HPC) Solution and other products, allow remote attackers to inject arbitrary web script or HTML via (1) the name element in an XML template to templates_import.php; and allow remote authenticated administrators to inject arbitrary web script or HTML via vectors related to (2) cdef.php, (3) data_input.php, (4) data_queries.php, (5) data_sources.php, (6) data_templates.php, (7) gprint_presets.php, (8) graph.php, (9) graphs_new.php, (10) graphs.php, (11) graph_templates_inputs.php, (12) graph_templates_items.php, (13) graph_templates.php, (14) graph_view.php, (15) host.php, (16) host_templates.php, (17) lib/functions.ph
Debian
CVE-2010-2545: cacti - Multiple cross-site scripting (XSS) vulnerabilities in Cacti before 0.8.7g, as u...
vendor_debian·2010·CVSS 4.3
CVE-2010-2545 [MEDIUM] CVE-2010-2545: cacti - Multiple cross-site scripting (XSS) vulnerabilities in Cacti before 0.8.7g, as u...
Multiple cross-site scripting (XSS) vulnerabilities in Cacti before 0.8.7g, as used in Red Hat High Performance Computing (HPC) Solution and other products, allow remote attackers to inject arbitrary web script or HTML via (1) the name element in an XML template to templates_import.php; and allow remote authenticated administrators to inject arbitrary web script or HTML via vectors related to (2) cdef.php, (3) data_input.php, (4) data_queries.php, (5) data_sources.php, (6) data_templates.php, (7) gprint_presets.php, (8) graph.php, (9) graphs_new.php, (10) graphs.php, (11) graph_templates_inputs.php, (12) graph_templates_items.php, (13) graph_templates.php, (14) graph_view.php, (15) host.php, (16) host_templates.php, (17) lib/functions.php, (18) lib/html_form.php, (19) lib/html_form_templat
Suricata
ET WEB_SPECIFIC_APPS Cacti cacti/utilities.php Cross Site Scripting Attempt
suricata·2010-09-28
CVE-2010-2544 ET WEB_SPECIFIC_APPS Cacti cacti/utilities.php Cross Site Scripting Attempt
ET WEB_SPECIFIC_APPS Cacti cacti/utilities.php Cross Site Scripting Attempt
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Cacti cacti/utilities.php Cross Site Scripting Attempt"; flow:established,to_server; http.uri; content:"/cacti/utilities.php"; nocase; content:"tail_lines="; nocase; content:"message_type="; nocase; content:"filter="; nocase; pcre:"/filter\x3D.+(script|alert|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange)/i"; reference:bid,42575; reference:cve,2010-2544; reference:cve,2010-2545; classtype:web-application-attack; sid:2011423; rev:4; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_09_28, cve CVE_2010_2544, deployment
No public exploits indexed.
http://cacti.net/release_notes_0_8_7g.phphttp://marc.info/?l=oss-security&m=127978954522586&w=2http://marc.info/?l=oss-security&m=128017203704299&w=2http://secunia.com/advisories/41041http://svn.cacti.net/viewvc?view=rev&revision=6037http://svn.cacti.net/viewvc?view=rev&revision=6038http://svn.cacti.net/viewvc?view=rev&revision=6041http://svn.cacti.net/viewvc?view=rev&revision=6042http://www.mandriva.com/security/advisories?name=MDVSA-2010:160http://www.securityfocus.com/bid/42575http://www.vupen.com/english/advisories/2010/2132https://bugzilla.redhat.com/show_bug.cgi?id=459229https://exchange.xforce.ibmcloud.com/vulnerabilities/61227https://rhn.redhat.com/errata/RHSA-2010-0635.htmlhttp://cacti.net/release_notes_0_8_7g.phphttp://marc.info/?l=oss-security&m=127978954522586&w=2http://marc.info/?l=oss-security&m=128017203704299&w=2http://secunia.com/advisories/41041http://svn.cacti.net/viewvc?view=rev&revision=6037http://svn.cacti.net/viewvc?view=rev&revision=6038http://svn.cacti.net/viewvc?view=rev&revision=6041http://svn.cacti.net/viewvc?view=rev&revision=6042http://www.mandriva.com/security/advisories?name=MDVSA-2010:160http://www.securityfocus.com/bid/42575http://www.vupen.com/english/advisories/2010/2132https://bugzilla.redhat.com/show_bug.cgi?id=459229https://exchange.xforce.ibmcloud.com/vulnerabilities/61227https://rhn.redhat.com/errata/RHSA-2010-0635.html
2010-08-23
Published