Vulnerability CVE-2010-2545 - CERT Civis.Net

Vulnerability Name:

CVE-2010-2545 (CCN-61227)

Assigned:

2010-08-19

Published:

2010-08-19

Updated:

2023-02-13

Summary:

CVSS v3 Severity:

5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): Low Availibility (A): None

CVSS v2 Severity:

4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
3.7 Low (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:H/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Authentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): Partial Availibility (A): None

4.3 Medium (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
3.7 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:H/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Athentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): Partial Availibility (A): None

Vulnerability Consequences:

Gain Access

References:

Source: secalert@redhat.com
Type: Vendor Advisory
secalert@redhat.com

Source: MITRE
Type: CNA
CVE-2010-2545

Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com

Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com

Source: CCN
Type: SA41041
Red Hat High Performance Computing (HPC) Solution Multiple Vulnerabilities

Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com

Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com

Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com

Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com

Source: CCN
Type: Cacti Web site
Index of /downloads

Source: DEBIAN
Type: DSA-2384
cacti -- several vulnerabilities

Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com

Source: CCN
Type: OSVDB ID: 67505
Cacti templates_import.php XML Template name Element XSS

Source: CCN
Type: OSVDB ID: 67506
Cacti cdef.php Unspecified Parameter XSS

Source: CCN
Type: OSVDB ID: 67507
Cacti data_input.php Unspecified Parameter XSS

Source: CCN
Type: OSVDB ID: 67508
Cacti data_queries.php Unspecified Parameter XSS

Source: CCN
Type: OSVDB ID: 67509
Cacti data_sources.php Unspecified Parameter XSS

Source: CCN
Type: OSVDB ID: 67510
Cacti data_templates.php Unspecified Parameter XSS

Source: CCN
Type: OSVDB ID: 67511
Cacti gprint_presets.php Unspecified Parameter XSS

Source: CCN
Type: OSVDB ID: 67512
Cacti graph.php Unspecified Parameter XSS

Source: CCN
Type: OSVDB ID: 67513
Cacti graphs_new.php Unspecified Parameter XSS

Source: CCN
Type: OSVDB ID: 67514
Cacti graphs.php Unspecified Parameter XSS

Source: CCN
Type: OSVDB ID: 67515
Cacti graph_templates_inputs.php Unspecified Parameter XSS

Source: CCN
Type: OSVDB ID: 67516
Cacti graph_templates_items.php Unspecified Parameter XSS

Source: CCN
Type: OSVDB ID: 67517
Cacti graph_templates.php Unspecified Parameter XSS

Source: CCN
Type: OSVDB ID: 67518
Cacti graph_view.php Unspecified Parameter XSS

Source: CCN
Type: OSVDB ID: 67519
Cacti host.php Unspecified Parameter XSS

Source: CCN
Type: OSVDB ID: 67520
Cacti host_templates.php Unspecified Parameter XSS

Source: CCN
Type: OSVDB ID: 67521
Cacti lib/functions.php Unspecified Parameter XSS

Source: CCN
Type: OSVDB ID: 67522
Cacti lib/html_form.php Unspecified Parameter XSS

Source: CCN
Type: OSVDB ID: 67523
Cacti lib/html_form_template.php Unspecified Parameter XSS

Source: CCN
Type: OSVDB ID: 67524
Cacti lib/html.php Unspecified Parameter XSS

Source: CCN
Type: OSVDB ID: 67525
Cacti lib/html_tree.php Unspecified Parameter XSS

Source: CCN
Type: OSVDB ID: 67526
Cacti lib/rrd.php Unspecified Parameter XSS

Source: CCN
Type: OSVDB ID: 67527
Cacti rra.php Unspecified Parameter XSS

Source: CCN
Type: OSVDB ID: 67528
Cacti tree.php Unspecified Parameter XSS

Source: CCN
Type: OSVDB ID: 67529
Cacti user_admin.php Unspecified Parameter XSS

Source: CCN
Type: BID-42575
Cacti Cross Site Scripting and HTML Injection Vulnerabilities

Source: secalert@redhat.com
Type: Exploit
secalert@redhat.com

Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com

Source: CCN
Type: Red Hat Bugzilla Bug 459229
(CVE-2010-2545) CVE-2010-2545 cacti: XSS via various object names or descriptions

Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com

Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com

Source: XF
Type: UNKNOWN
cacti-templatesimport-xss(61227)

Source: CCN
Type: RHSA-2010:0635-1
Red Hat High Performance Computing (HPC) Solution 5.5

Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com

Vulnerable Configuration:

Configuration CCN 1:

cpe:/a:cacti:cacti:0.8.6:*:*:*:*:*:*:*

OR cpe:/a:cacti:cacti:0.8.5a:*:*:*:*:*:*:*

OR cpe:/a:cacti:cacti:0.8.6d:*:*:*:*:*:*:*

OR cpe:/a:cacti:cacti:0.8.6c:*:*:*:*:*:*:*

OR cpe:/a:cacti:cacti:0.8.6e:*:*:*:*:*:*:*

OR cpe:/a:cacti:cacti:0.8.6g:*:*:*:*:*:*:*

OR cpe:/a:cacti:cacti:0.8.6i:*:*:*:*:*:*:*

OR cpe:/a:cacti:cacti:0.8.6j:*:*:*:*:*:*:*

OR cpe:/a:cacti:cacti:0.8:*:*:*:*:*:*:*

OR cpe:/a:cacti:cacti:0.8.7:*:*:*:*:*:*:*

OR cpe:/a:cacti:cacti:0.8.6h:*:*:*:*:*:*:*

OR cpe:/a:cacti:cacti:0.8.6f:*:*:*:*:*:*:*

OR cpe:/a:cacti:cacti:0.8.6b:*:*:*:*:*:*:*

OR cpe:/a:cacti:cacti:0.8.6a:*:*:*:*:*:*:*

OR cpe:/a:cacti:cacti:0.8.5:*:*:*:*:*:*:*

OR cpe:/a:cacti:cacti:0.8.4:*:*:*:*:*:*:*

OR cpe:/a:cacti:cacti:0.8.3a:*:*:*:*:*:*:*

OR cpe:/a:cacti:cacti:0.8.3:*:*:*:*:*:*:*

OR cpe:/a:cacti:cacti:0.8.2a:*:*:*:*:*:*:*

OR cpe:/a:cacti:cacti:0.8.2:*:*:*:*:*:*:*

OR cpe:/a:cacti:cacti:0.8.1:*:*:*:*:*:*:*

OR cpe:/a:cacti:cacti:0.8.7a:*:*:*:*:*:*:*

OR cpe:/a:cacti:cacti:0.8.6k:*:*:*:*:*:*:*

OR cpe:/a:cacti:cacti:0.8.7e:*:*:*:*:*:*:*

OR cpe:/a:cacti:cacti:0.8.7b:*:*:*:*:*:*:*

OR cpe:/a:cacti:cacti:0.8.7c:*:*:*:*:*:*:*

OR cpe:/a:cacti:cacti:0.8.7d:*:*:*:*:*:*:*

OR cpe:/a:cacti:cacti:0.6.7:*:*:*:*:*:*:*

AND

cpe:/o:mandrakesoft:mandrake_linux_corporate_server:4.0:*:*:*:*:*:*:*

OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:4.0::x86_64:*:*:*:*:*

OR cpe:/o:mandriva:enterprise_server:5:*:*:*:*:*:*:*

OR cpe:/o:mandriva:enterprise_server:5:*:*:*:x86_64:*:*:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:org.mitre.oval:def:15384	P	DSA-2384-2 cacti -- several	2014-06-23
oval:org.mitre.oval:def:15413	P	DSA-2384-1 cacti -- several	2014-06-23