REDHAT-BUG-783584
First published: Fri Jan 20 2012(Updated: )
A flaw was reported [1] in smokeping 2.6 (and most likely earlier versions) which malicious remote users could abuse to conduct cross-site scripting attacks.. Input passed to the "displaymode" parameter in the smokeping CGI script is not properly sanitized before being returned to the user, which can be used to execute arbitrary HTML and script code in a user's browser session in the context of an affected site. Smokeping 2.6.7 has been released to correct this flaw. [1] <a href="http://holisticinfosec.org/content/view/188/45/">http://holisticinfosec.org/content/view/188/45/</a>
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Oetiker Smokeping | <2.6 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://holisticinfosec.org/content/view/188/45/
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=783585
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=556619&action=diff
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=556619&action=edit
- https://access.redhat.com/security/cve/CVE-2012-0790
- https://bugzilla.redhat.com/show_bug.cgi?id=783584
Frequently Asked Questions
What is the severity of REDHAT-BUG-783584?
The severity of REDHAT-BUG-783584 is categorized as a potential security vulnerability due to the risk of cross-site scripting attacks.
How do I fix REDHAT-BUG-783584?
To fix REDHAT-BUG-783584, ensure that you sanitize input passed to the 'displaymode' parameter in the smokeping CGI script.
Which versions of Smokeping are affected by REDHAT-BUG-783584?
Smokeping versions up to and including 2.6 are affected by REDHAT-BUG-783584.
What type of attack can REDHAT-BUG-783584 allow?
REDHAT-BUG-783584 allows malicious remote users to conduct cross-site scripting attacks.
Who reported the REDHAT-BUG-783584 vulnerability?
The vulnerability REDHAT-BUG-783584 was reported by an unknown individual or entity as part of the bug tracking process.
- agent/references
- agent/type
- agent/first-publish-date
- agent/last-modified-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2012-0790
- agent/severity
- agent/description
- agent/event
- agent/trending
- agent/source
- agent/tags
- agent/softwarecombine
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/smokeping
- canonical/smokeping smokeping