CVE-2008-0783

Published: Feb 14, 2008Modified: Apr 23, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

Multiple cross-site scripting (XSS) vulnerabilities in Cacti 0.8.7 before 0.8.7b and 0.8.6 before 0.8.6k allow remote attackers to inject arbitrary web script or HTML via (1) the view_type parameter to graph.php; (2) the filter parameter to graph_view.php; (3) the action parameter to the draw_navigation_text function in lib/functions.php, reachable through index.php (aka the login page) or data_input.php; or (4) the login_username parameter to index.php.

Affected (16)

Products: Cacti: Cacti

1 product

Configuration A

16 vulnerable

Vulnerable Software	Affected Versions
Cacti Cacti	Version 0.6.7
Cacti Cacti	Version 0.8.1
Cacti Cacti	Version 0.8.2
Cacti Cacti	Version 0.8.2a
Cacti Cacti	Version 0.8.3
Cacti Cacti	Version 0.8.3a
Cacti Cacti	Version 0.8.4
Cacti Cacti	Version 0.8.5
Cacti Cacti	Version 0.8.5a
Cacti Cacti	Version 0.8.6c
Cacti Cacti	Version 0.8.6f
Cacti Cacti	Version 0.8.6i
Cacti Cacti	Version 0.8.6j
Cacti Cacti	Version 0.8.7
Cacti Cacti	Version 0.8.7a
Cacti Cacti	Version 0.8

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (44)

http://bugs.cacti.net/view.php?id=1245

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00001.html

Source: cve@mitre.org

http://secunia.com/advisories/28872

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/28976

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/29242

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/29274

Source: cve@mitre.org

http://secunia.com/advisories/30045

Source: cve@mitre.org

Vendor Advisory

http://security.gentoo.org/glsa/glsa-200803-18.xml

Source: cve@mitre.org

http://securityreason.com/securityalert/3657

Source: cve@mitre.org

http://www.cacti.net/release_notes_0_8_7b.php

Source: cve@mitre.org

Patch

http://www.debian.org/security/2008/dsa-1569

Source: cve@mitre.org

http://www.mandriva.com/security/advisories?name=MDVSA-2008:052

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/488013/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/488018/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/bid/27749

Source: cve@mitre.org

ExploitPatch

http://www.securityfocus.com/bid/34991

Source: cve@mitre.org

http://www.securitytracker.com/id?1019414

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2008/0540

Source: cve@mitre.org

Vendor Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=432758

Source: cve@mitre.org

https://exchange.xforce.ibmcloud.com/vulnerabilities/50575

Source: cve@mitre.org

https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00570.html

Source: cve@mitre.org

https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00593.html

Source: cve@mitre.org

http://bugs.cacti.net/view.php?id=1245

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00001.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/28872

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://secunia.com/advisories/28976

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://secunia.com/advisories/29242

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://secunia.com/advisories/29274

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/30045

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://security.gentoo.org/glsa/glsa-200803-18.xml

Source: af854a3a-2127-422b-91ae-364da2661108

http://securityreason.com/securityalert/3657

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.cacti.net/release_notes_0_8_7b.php

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

http://www.debian.org/security/2008/dsa-1569

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.mandriva.com/security/advisories?name=MDVSA-2008:052

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/archive/1/488013/100/0/threaded

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/archive/1/488018/100/0/threaded

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/27749

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitPatch

http://www.securityfocus.com/bid/34991

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securitytracker.com/id?1019414

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.vupen.com/english/advisories/2008/0540

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=432758

Source: af854a3a-2127-422b-91ae-364da2661108

https://exchange.xforce.ibmcloud.com/vulnerabilities/50575

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00570.html

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00593.html

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.