Cacti 0.8.7g XSS

2010.08.26
Credit: Tomas Hoger
Risk: Low
Local: No
Remote: Yes
CWE: CWE-79

Cacti 0.8.7g was released some days ago: http://cacti.net/release_notes_0_8_7g.php Release notes mention couple of security issue previously fixed in (withdrawn) 0.8.7f, but adds new protections against couple of XSS issues. "XSS 4" from CVE-2009-4032 was not fixed previously: https://bugzilla.redhat.com/show_bug.cgi?id=541279#c17 Fixed in include/top_graph_header.php change in: http://svn.cacti.net/viewvc?view=rev&revision=6025 Search pattern in log file viewer was not filtered for bad characters, or escaped before echoing pattern back to page: https://bugzilla.redhat.com/show_bug.cgi?id=459105 Possible victims are administrative users with access to log viewer page. Fixed in r6025, which adds escaping to other search patterns too, but others were filtered previously. Multiple persistent XSS via various item names or descriptions. Attacker needs to have certain administrative privileges, so this is fairly lame issue. https://bugzilla.redhat.com/show_bug.cgi?id=459229 Originally discovered for template names, where template XML import provides additional vector (trusted admin tricked to import untrusted template vs. untrusted admin). HTML escaping added on various places in r6037, r6038, r6041 and r6042.

References:

https://rhn.redhat.com/errata/RHSA-2010-0635.html
https://bugzilla.redhat.com/show_bug.cgi?id=459229
http://www.securityfocus.com/bid/42575
http://svn.cacti.net/viewvc?view=rev&revision=6042
http://svn.cacti.net/viewvc?view=rev&revision=6041
http://svn.cacti.net/viewvc?view=rev&revision=6038
http://svn.cacti.net/viewvc?view=rev&revision=6037
http://secunia.com/advisories/41041
http://marc.info/?l=oss-security&m=128017203704299&w=2
http://marc.info/?l=oss-security&m=127978954522586&w=2
http://cacti.net/release_notes_0_8_7g.php


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2022, cxsecurity.com

 

Back to Top