Published: 24/01/2012 Updated: 25/01/2012

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

VMScore: 383

Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N

Cross-site scripting (XSS) vulnerability in smokeping_cgi in Smokeping 2.4.2, 2.6.6, and other versions prior to 2.6.7 allows remote malicious users to inject arbitrary web script or HTML via the displaymode parameter.

Vulnerable Product	Search on Vulmon	Subscribe to Product
oetiker smokeping 2.6.2
oetiker smokeping 2.6.0
oetiker smokeping 2.4.0
oetiker smokeping 2.3.5
oetiker smokeping
oetiker smokeping 2.6.5
oetiker smokeping 2.6.4
oetiker smokeping 2.3.3
oetiker smokeping 2.3.2
oetiker smokeping 2.3.1
oetiker smokeping 2.3.0
oetiker smokeping 2.0.6
oetiker smokeping 2.0.5
oetiker smokeping 2.0.4
oetiker smokeping 2.0.3
oetiker smokeping 1.28
oetiker smokeping 1.27
oetiker smokeping 1.26
oetiker smokeping 1.25
oetiker smokeping 1.12
oetiker smokeping 1.11
oetiker smokeping 1.10
oetiker smokeping 1.9
oetiker smokeping 1.8
oetiker smokeping 0.99.14
oetiker smokeping 0.99.13
oetiker smokeping 0.99.12
oetiker smokeping 0.99.11
oetiker smokeping 2.5.1
oetiker smokeping 2.5.0
oetiker smokeping 2.4.2
oetiker smokeping 2.4.1
oetiker smokeping 2.2.2
oetiker smokeping 2.2.1
oetiker smokeping 2.2.0
oetiker smokeping 2.1.1
oetiker smokeping 2.0
oetiker smokeping 1.38
oetiker smokeping 1.37
oetiker smokeping 1.36
oetiker smokeping 1.20
oetiker smokeping 1.19
oetiker smokeping 1.18
oetiker smokeping 1.17
oetiker smokeping 1.3
oetiker smokeping 1.2
oetiker smokeping 1.1
oetiker smokeping 1.0
oetiker smokeping 0.99.6
oetiker smokeping 0.99.5
oetiker smokeping 2.2.6
oetiker smokeping 2.2.4
oetiker smokeping 2.0.9
oetiker smokeping 2.0.7
oetiker smokeping 2.0.2
oetiker smokeping 2.0.0
oetiker smokeping 1.34
oetiker smokeping 1.30
oetiker smokeping 1.23
oetiker smokeping 1.21
oetiker smokeping 1.16
oetiker smokeping 1.14
oetiker smokeping 1.7
oetiker smokeping 1.5
oetiker smokeping 0.99.17
oetiker smokeping 0.99.15
oetiker smokeping 0.99.10
oetiker smokeping 0.99.8
oetiker smokeping 2.6.3
oetiker smokeping 2.6.1
oetiker smokeping 2.3.6
oetiker smokeping 2.3.4
oetiker smokeping 2.2.7
oetiker smokeping 2.2.5
oetiker smokeping 2.2.3
oetiker smokeping 2.1.0
oetiker smokeping 2.0.8
oetiker smokeping 2.0.1
oetiker smokeping 1.31
oetiker smokeping 1.29
oetiker smokeping 1.24
oetiker smokeping 1.22
oetiker smokeping 1.15
oetiker smokeping 1.13
oetiker smokeping 1.6
oetiker smokeping 1.4
oetiker smokeping 0.99.18
oetiker smokeping 0.99.16
oetiker smokeping 0.99.9
oetiker smokeping 0.99.7

Debian Bug report logs - #659899 CVE-2012-0790: XSS Package: smokeping; Maintainer for smokeping is Gabriel Filion <gabriel@koumbitorg>; Source for smokeping is src:smokeping (PTS, buildd, popcon) Reported by: Moritz Muehlenhoff <jmm@debianorg> Date: Tue, 14 Feb 2012 17:06:01 UTC Severity: grave Tags: security Fo ...

A cross-site scripting vulnerability was discovered in smokeping, a latency logging and graphing system Input passed to the displaymode parameter was not properly sanitized An attacker could use this flaw to execute arbitrary HTML and script code in a user's browser session in the context of an affected site For the stable distribution (squeeze) ...

CWE-79 http://oss.oetiker.ch/smokeping/pub/CHANGES http://www.openwall.com/lists/oss-security/2012/01/21/1 https://bugzilla.redhat.com/show_bug.cgi?id=783584 http://holisticinfosec.org/content/view/188/45/https://bugs.gentoo.org/show_bug.cgi?id=399553 http://secunia.com/advisories/47678 http://www.securityfocus.com/bid/51584 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=659899 https://www.debian.org/security/./dsa-2651 https://nvd.nist.gov

CVE-2012-0790

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect