PT-2009-6215 · Cacti · Cacti

Moritz Naumann · Published 2009-11-27 · Updated 2023-02-13 · CVE-2009-4032

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Cacti version 0.8.7e

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. The affected areas include graph.php, include/top graph header.php, lib/html form.php, and lib/timespan settings.php. Specifically, the vulnerabilities can be exploited through the graph end or graph start parameters to graph.php, the date1 parameter in a tree action to graph view.php, and the page refresh and default dual pane width parameters to graph settings.php.

Recommendations For Cacti version 0.8.7e, consider disabling access to the affected PHP files until a patch is available. Restrict access to the graph.php, graph view.php, and graph settings.php endpoints to minimize the risk of exploitation. Avoid using the graph end, graph start, date1, page refresh, and default dual pane width parameters in the affected API endpoints until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2009-4032

DSA-1954-1

RHSA-2010:0635

Affected Products

Cacti

References · 31

• 🔥 https://exploit-db.com/exploits/10234 · Exploit
• 🔥 https://exploit-db.com/exploits/33374 · Exploit
• https://redhat.com/archives/fedora-package-announce/2010-January/msg00166.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2009-4032 · Vendor Advisory
• http://secunia.com/advisories/37934 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2009-4032 · Vendor Advisory
• http://openwall.com/lists/oss-security/2009/11/25/4 · Patch
• https://redhat.com/archives/fedora-package-announce/2009-December/msg01390.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-4032 · Security Note
• http://secunia.com/advisories/41041 · Vendor Advisory
• http://docs.cacti.net/#cross-site_scripting_fixes · Patch
• https://osv.dev/vulnerability/CVE-2009-4032 · Vendor Advisory
• https://rhn.redhat.com/errata/RHSA-2010-0635.html · Vendor Advisory
• http://secunia.com/advisories/37481 · Vendor Advisory
• http://cacti.net/downloads/patches/0.8.7e/cross_site_fix.patch · Patch