CVE-2012-0790
published 2019-12-11CVE-2012-0790: smokeping before 2.6.9 has XSS (incomplete fix for CVE-2012-0790)
PriorityP416medium4.3CVSS 2.0
AVNACMAuNCNIPAN
EPSS
1.34%
68.5th percentile
smokeping before 2.6.9 has XSS (incomplete fix for CVE-2012-0790)
Affected
103 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | smokeping | < smokeping 2.6.8-2 (bookworm) | smokeping 2.6.8-2 (bookworm) |
| debian | smokeping | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| oetiker | smokeping | <= 2.6.6 | — |
| oetiker | smokeping | — | — |
| oetiker | smokeping | — | — |
| oetiker | smokeping | — | — |
| oetiker | smokeping | — | — |
| oetiker | smokeping | — | — |
| oetiker | smokeping | — | — |
| oetiker | smokeping | — | — |
| oetiker | smokeping | — | — |
| oetiker | smokeping | — | — |
| oetiker | smokeping | — | — |
| oetiker | smokeping | — | — |
| oetiker | smokeping | — | — |
| oetiker | smokeping | — | — |
| oetiker | smokeping | — | — |
| oetiker | smokeping | — | — |
| oetiker | smokeping | — | — |
| oetiker | smokeping | — | — |
CVSS provenance
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
osv4.3MEDIUM
vendor_debian4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-3ppq-w2m7-6qvc: Cross-site scripting (XSS) vulnerability in smokeping_cgi in Smokeping 2
ghsa_unreviewed·2022-05-17
CVE-2012-0790 [MEDIUM] CWE-79 GHSA-3ppq-w2m7-6qvc: Cross-site scripting (XSS) vulnerability in smokeping_cgi in Smokeping 2
Cross-site scripting (XSS) vulnerability in smokeping_cgi in Smokeping 2.4.2, 2.6.6, and other versions before 2.6.7 allows remote attackers to inject arbitrary web script or HTML via the displaymode parameter.
GHSA
GHSA-gj7j-7773-fpw5: smokeping before 2
ghsa_unreviewed·2022-05-05·CVSS 4.3
CVE-2013-4158 [MEDIUM] GHSA-gj7j-7773-fpw5: smokeping before 2
smokeping before 2.6.9 has XSS (incomplete fix for CVE-2012-0790)
OSV
CVE-2013-4158: smokeping before 2
osv·2019-12-11·CVSS 4.3
CVE-2013-4158 [MEDIUM] CVE-2013-4158: smokeping before 2
smokeping before 2.6.9 has XSS (incomplete fix for CVE-2012-0790)
OSV
CVE-2012-0790: Cross-site scripting (XSS) vulnerability in smokeping_cgi in Smokeping 2
osv·2012-01-24·CVSS 4.3
CVE-2012-0790 [MEDIUM] CVE-2012-0790: Cross-site scripting (XSS) vulnerability in smokeping_cgi in Smokeping 2
Cross-site scripting (XSS) vulnerability in smokeping_cgi in Smokeping 2.4.2, 2.6.6, and other versions before 2.6.7 allows remote attackers to inject arbitrary web script or HTML via the displaymode parameter.
Debian
CVE-2013-4158: smokeping - smokeping before 2.6.9 has XSS (incomplete fix for CVE-2012-0790)
vendor_debian·2013·CVSS 4.3
CVE-2013-4158 [MEDIUM] CVE-2013-4158: smokeping - smokeping before 2.6.9 has XSS (incomplete fix for CVE-2012-0790)
smokeping before 2.6.9 has XSS (incomplete fix for CVE-2012-0790)
Scope: local
bookworm: resolved
bullseye: resolved
forky: resolved
sid: resolved
trixie: resolved
Debian
CVE-2012-0790: smokeping - Cross-site scripting (XSS) vulnerability in smokeping_cgi in Smokeping 2.4.2, 2....
vendor_debian·2012·CVSS 4.3
CVE-2012-0790 [MEDIUM] CVE-2012-0790: smokeping - Cross-site scripting (XSS) vulnerability in smokeping_cgi in Smokeping 2.4.2, 2....
Cross-site scripting (XSS) vulnerability in smokeping_cgi in Smokeping 2.4.2, 2.6.6, and other versions before 2.6.7 allows remote attackers to inject arbitrary web script or HTML via the displaymode parameter.
Scope: local
bookworm: resolved (fixed in 2.6.8-2)
bullseye: resolved (fixed in 2.6.8-2)
forky: resolved (fixed in 2.6.8-2)
sid: resolved (fixed in 2.6.8-2)
trixie: resolved (fixed in 2.6.8-2)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2013-4158 smokeping: XSS flaw (incomplete fix for CVE-2012-0790)
bugzilla·2013-07-20·CVSS 4.3
CVE-2013-4158 [MEDIUM] CVE-2013-4158 smokeping: XSS flaw (incomplete fix for CVE-2012-0790)
CVE-2013-4158 smokeping: XSS flaw (incomplete fix for CVE-2012-0790)
Seth Arnold ([email protected]) reports:
Hello Kurt, Steve, all,
I am requesting a 2012 CVE for an incomplete security fix in smokeping,
fixed in version 2.6.9.
CVE-2012-0790 was assigned to smokeping for XSS flaws.
The fix for CVE-2012-0790 in smokeping 2.6.7 was incomplete. The
filtering used this blacklist:
$mode =~ s/[<>&%]/./g;
The version in 2.6.9 uses the following blacklist:
my $xssBadRx = qr/[<>%&'";]/;
(', ", and ; have been added. When it is used, blacklist chars are now
turned to _ rather than . ) The 2.6.9 version prevents escaping via " characters.
The incomplete fix is in 2.6.7 and 2.6.8.
This flaw was discovered by Florian Weimer [1] in 2012 and brought to
our attention [2] in 2013.
The
Bugzilla
CVE-2012-0790 smokeping: XSS flaw
bugzilla·2012-01-20·CVSS 4.3
CVE-2012-0790 [MEDIUM] CVE-2012-0790 smokeping: XSS flaw
CVE-2012-0790 smokeping: XSS flaw
A flaw was reported [1] in smokeping 2.6 (and most likely earlier versions) which malicious remote users could abuse to conduct cross-site scripting attacks.. Input passed to the "displaymode" parameter in the smokeping CGI script is not properly sanitized before being returned to the user, which can be used to execute arbitrary HTML and script code in a user's browser session in the context of an affected site.
Smokeping 2.6.7 has been released to correct this flaw.
[1] http://holisticinfosec.org/content/view/188/45/
Discussion:
Created smokeping tracking bugs for this issue
Affects: fedora-all [bug 783585]
---
Created attachment 556619
patch to correct the flaw
Derived from diffing 2.6.7 to 2.6.6; this looks like the relevant bits required to fi
http://lists.fedoraproject.org/pipermail/package-announce/2013-August/113987.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2013-August/114008.htmlhttp://www.openwall.com/lists/oss-security/2013/07/20/2http://www.securityfocus.com/bid/61371https://access.redhat.com/security/cve/cve-2013-4158https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4158https://exchange.xforce.ibmcloud.com/vulnerabilities/85887https://security-tracker.debian.org/tracker/CVE-2013-4158http://lists.fedoraproject.org/pipermail/package-announce/2013-August/113987.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2013-August/114008.htmlhttp://www.openwall.com/lists/oss-security/2013/07/20/2http://www.securityfocus.com/bid/61371https://access.redhat.com/security/cve/cve-2013-4158https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4158https://exchange.xforce.ibmcloud.com/vulnerabilities/85887https://security-tracker.debian.org/tracker/CVE-2013-4158
2019-12-11
Published