Re: CVE Request for cacti

["Steven M. Christey" <coley () linus mitre org>]

On Mon, 18 May 2009, Robert Buchholz wrote:

> Do you have any indication this is not covered by CVE-2008-0783?

CVE-2008-0783 as intended by MITRE is only about the specific vectors that
are listed there.  Henri's vector is "new."  I wasn't aware that Cacti
fixed other issues - if so, we should probably assign a new CVE for "all
the other XSS fixed in 0.8.7b" and mention Henri's vector as one of them.

- Steve


> Robert
>
> [1]
> http://www.cacti.net/downloads/patches/0.8.7a/multiple_vulnerabilities-0.8.7a.patch
> [2] http://lists.debian.org/debian-security-announce/2008/msg00144.html