CVE-2010-1644: XSS
Multiple cross-site scripting (XSS) vulnerabilities in Cacti before 0.8.7f, as used in Red Hat High Performance Computing (HPC) Solution and other products, allow remote attackers to inject arbitrary web script or HTML via the (1) hostname or (2) description parameter to host.php, or (3) the hostid parameter to datasources.php.
Other sources
Multiple XSS issues were discovered in Cacti and fixed in version 0.8.7f: - host.php via "hostname" and "description" parameters - datasources.php via "hostid" parameter
References: http://www.vupen.com/english/advisories/2010/1203 http://www.cacti.net/releasenotes087f.php
Upstream commit: http://svn.cacti.net/viewvc?view=rev&revision=5901
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2010-1644?
The CVE-2010-1644 vulnerability has been classified as a moderate severity issue due to the potential for cross-site scripting attacks.
How do I fix CVE-2010-1644?
To address CVE-2010-1644, upgrade to Cacti version 0.8.7f or later, which contains the necessary patches.
Which versions of Cacti are affected by CVE-2010-1644?
CVE-2010-1644 affects Cacti versions prior to 0.8.7f, including several earlier versions down to 0.5.
What types of attacks are possible with CVE-2010-1644?
CVE-2010-1644 allows attackers to perform cross-site scripting (XSS) attacks, potentially compromising user accounts or data.
Are there any workarounds for CVE-2010-1644?
A recommended workaround for CVE-2010-1644 is to sanitize user input for the hostname and description parameters to prevent XSS.