Unscored severity · published Dec 20, 2007
CVE-2007-6465
Multiple cross-site scripting (XSS) vulnerabilities in ganglia-web in Ganglia before 3.0.6 allow remote attackers to inject arbitrary web script or HTML via the (1) c and (2) h…
–
CVSS
1.3%
EPSS
No
On KEV
Description
Multiple cross-site scripting (XSS) vulnerabilities in ganglia-web in Ganglia before 3.0.6 allow remote attackers to inject arbitrary web script or HTML via the (1) c and (2) h parameters to (a) web/host_gmetrics.php; the (3) G, (4) me, (5) x, (6) n, (7) v, (8) l, (9) vl, and (10) st parameters to (b) web/graph.php; and the (11) c, (12) G, (13) h, (14) r, (15) m, (16) s, (17) cr, (18) hc, (19) sh, (20) p, (21) t, (22) jr, (23) js, (24) gw, (25) z, and (26) gs parameters to (c) web/get_context.php. NOTE: some of these details are obtained from third party information.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 70% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GA
Ganglia · Ganglia
through 3.05 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2007-6465
CVE.org
https://www.cve.org/CVERecord?id=CVE-2007-6465
Patch
http://secunia.com/advisories/28116
Patch
http://sourceforge.net/project/shownotes.php?release_id=562168
www.osvdb.org
http://www.osvdb.org/39515
www.osvdb.org
http://www.osvdb.org/39516
www.osvdb.org
http://www.osvdb.org/39517
www.securityfocus.com
http://www.securityfocus.com/bid/26895
More from Ganglia
–
CVE-2011-3741
Ganglia 3.1.7 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated…
–
CVE-2009-0241
Stack-based buffer overflow in the process_path function in gmetad/server.c in Ganglia 3.1.1 allows remote attackers to cause a denial of service (crash) via a request to the…