4.3

CVE-2010-2543

Cross-site scripting (XSS) vulnerability in include/top_graph_header.php in Cacti before 0.8.7g allows remote attackers to inject arbitrary web script or HTML via the graph_start parameter to graph.php.  NOTE: this vulnerability exists because of an incorrect fix for CVE-2009-4032.2.b.

Data is provided by the National Vulnerability Database (NVD)
Cacti ≫ Cacti Version <= 0.8.7f
Cacti ≫ Cacti Version0.5 Update-
Cacti ≫ Cacti Version0.6
Cacti ≫ Cacti Version0.6.1
Cacti ≫ Cacti Version0.6.2
Cacti ≫ Cacti Version0.6.3
Cacti ≫ Cacti Version0.6.4
Cacti ≫ Cacti Version0.6.5
Cacti ≫ Cacti Version0.6.6
Cacti ≫ Cacti Version0.6.7
Cacti ≫ Cacti Version0.6.8
Cacti ≫ Cacti Version0.6.8a
Cacti ≫ Cacti Version0.8
Cacti ≫ Cacti Version0.8.1
Cacti ≫ Cacti Version0.8.2
Cacti ≫ Cacti Version0.8.2a
Cacti ≫ Cacti Version0.8.3
Cacti ≫ Cacti Version0.8.3a
Cacti ≫ Cacti Version0.8.4
Cacti ≫ Cacti Version0.8.5
Cacti ≫ Cacti Version0.8.5a
Cacti ≫ Cacti Version0.8.6
Cacti ≫ Cacti Version0.8.6a
Cacti ≫ Cacti Version0.8.6b
Cacti ≫ Cacti Version0.8.6c
Cacti ≫ Cacti Version0.8.6d
Cacti ≫ Cacti Version0.8.6f
Cacti ≫ Cacti Version0.8.6g
Cacti ≫ Cacti Version0.8.6h
Cacti ≫ Cacti Version0.8.6i
Cacti ≫ Cacti Version0.8.6j
Cacti ≫ Cacti Version0.8.6k
Cacti ≫ Cacti Version0.8.7
Cacti ≫ Cacti Version0.8.7a
Cacti ≫ Cacti Version0.8.7b
Cacti ≫ Cacti Version0.8.7c
Cacti ≫ Cacti Version0.8.7d
Cacti ≫ Cacti Version0.8.7e
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 5.87% 0.901
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:P/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.