Skip to content
Fencer Vulns
medium 4.3

CVE-2009-4032 json

Multiple cross-site scripting (XSS) vulnerabilities in Cacti 0.8.7e allow remote attackers to inject arbitrary web script or HTML via vecto…

published 2009-11-27 16 y ago modified 2026-06-16 4 mo ago also EUVD-2009-4003

cvss
4.3
version 2.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
5.7%
EPSS 5.7% chance of exploitation in 30 days, percentile 93%
public exploits
2
Exploit-DB

Summary

Multiple cross-site scripting (XSS) vulnerabilities in Cacti 0.8.7e allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) graph.php, (2) include/top_graph_header.php, (3) lib/html_form.php, and (4) lib/timespan_settings.php, as demonstrated by the (a) graph_end or (b) graph_start parameters to graph.php; (c) the date1 parameter in a tree action to graph_view.php; and the (d) page_refresh and (e) default_dual_pane_width parameters to graph_settings.php.

Patch / fix

  • cacti Debian 14, Debian 13, Debian 12 0.8.7e-1.1

debian advisories DEBIAN-CVE-2009-4032

  • pcm hpc solution 1.0 1.2-6
  • lava hpc solution 1.0 1.0-10
  • nrpe hpc solution 1.0 2.12-12.1.el5
  • ntop hpc solution 1.0 3.3.9-7.1.el5
  • cacti hpc solution 1.0 0.8.7g-1.1.el5
  • GeoIP hpc solution 1.0 1.4.7-0.1.20090931cvs.el5
  • iozone hpc solution 1.0 3-5.el5
  • netcdf hpc solution 1.0 3.6.2-7.el5

red hat advisories RHSA-2010:0635

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2009-4032 updated cvss 4.3

cacti: Multiple cross-site scripting flaws

  • Red Hat All currently supported Red Hat products
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Timeline

  1. First public exploit (EDB-33374)
  2. Published

Exploit prediction

5.74% chance of exploitation in the next 30 days, higher than 93% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • EDB-33374 Cacti 0.8.x - 'graph.php' Multiple Cross-Site Scripting Vulnerabilities webapps, 2009-11-21
  • EDB-10234 Cacti 0.8.7e - Multiple Vulnerabilities webapps, 2009-11-26

CVSS scores

assigned by version score vector
NVD 2.0 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N

Classification

Weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.