CVE-2024-52763

MEDIUMNuclei

ganglia ganglia-web Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Title source: VulnCheck
STIX 2.1 vulnerability

Record summary

CVE-2024-52763 has a selected CVSS score of 5.4 (medium); EIP currently links 1 Nuclei template.

Description

A cross-site scripting (XSS) vulnerability in the component /graph_all_periods.php of Ganglia-web v3.73 to v3.75 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the "g" parameter.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Jun 7, 2025 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Nov 20, 2024 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

ganglia-web

Browse ganglia / ganglia-web
VulnCheckVersion data not supplied

Nuclei templates

1
ProjectDiscoveryMEDIUMGanglia Web Interface (v3.7.3 - v3.7.5) - Cross-Site ScriptingCVSS 5.4

A cross-site scripting (XSS) vulnerability in the component /graph_all_periods.php of Ganglia-web v3.73 to v3.75 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the "g" parameter.

Impact

Authenticated attackers can execute arbitrary JavaScript or HTML in victim browsers by injecting malicious payloads into the g parameter.

Remediation

Update Ganglia-web to version 3.7.6 or later to address the XSS vulnerability in the graph parameter.

WeaknessesCWE-79
AuthorsDhiyaneshDK
Template tagscvecve2024xssgangliavkevvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:ganglia:ganglia-web:*:*:*:*:*:*:*:*
Shodan: http.html:"ganglia_form.submit()"
FOFA: body="ganglia_form.submit()"
https://github.com/ganglia/ganglia-web/issues/382

Source: ProjectDiscovery

References

2