A cross-site scripting (XSS) vulnerability in the component /master/header.php of Ganglia-web v3.73 to v3.76 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the "tz" parameter.
A cross-site scripting (XSS) vulnerability in the component /graphallperiods.php of Ganglia-web v3.73 to v3.75 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the "g" parameter.
ganglia-web (aka Ganglia Web Frontend) through 3.7.5 allows XSS via the header.php ce parameter.
ganglia-web (aka Ganglia Web Frontend) through 3.7.5 allows XSS via the header.php cs parameter.
A vulnerability of auth bypassing was found in Ganglia-web. It's easy to bypass auth by using boolean serialization like this: $ php -r "echo urlencode(serialize(array('user'=>'admin','group'=>'admin', 'token'=>true)));"
Vulnerable code:
https://github.com/ganglia/ganglia-web/blob/4e98ea69e0e18b388cdc73809ce54843a16ff87b/lib/GangliaAuth.php#L34-L46
Upstream report:
https://github.com/ganglia/ganglia-web/issues/267
CVE assignment:
http://seclists.org/oss-sec/2015/q3/502
A vulnerability of auth bypassing was found in Ganglia-web. It's easy to bypass auth by using boolean serialization like this: $ php -r "echo urlencode(serialize(array('user'=>'admin','group'=>'admin', 'token'=>true)));"
Vulnerable code:
https://github.com/ganglia/ganglia-web/blob/4e98ea69e0e18b388cdc73809ce54843a16ff87b/lib/GangliaAuth.php#L34-L46
Upstream report:
https://github.com/ganglia/ganglia-web/issues/267
CVE assignment:
http://seclists.org/oss-sec/2015/q3/502
A number of XSS flaws were reported in the Ganglia web frontend.
These flaws are not currently public.