{"id":"CVE-2024-52762","aliases":["DEBIAN-CVE-2024-52762","EUVD-2024-46044","GHSA-99p7-c89v-ph5p","UBUNTU-CVE-2024-52762"],"status":"published","title":"A cross-site scripting (XSS) vulnerability in the component /master/header.php of Ganglia-web v3...","description":"A cross-site scripting (XSS) vulnerability in the component /master/header.php of Ganglia-web v3.73 to v3.76 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the \"tz\" parameter.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.00774,"percentile":0.56229,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2024-11-19T00:00:00Z","modified":"2026-11-02T12:03:14Z","exploits":[{"source":"nuclei","id":"CVE-2024-52762","title":"Ganglia Web Interface (v3.7.3 - v3.7.6) - Cross-Site Scripting","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-52762.yaml"}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"ganglia-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.5.2-1","3.5.2-2","3.5.8-1","3.5.8-2","3.5.8-3","3.5.8-3.1","3.5.8-4","3.6.1-1","3.6.1-2","3.6.1-3","3.6.1-3.1"]},{"source":"osv","ecosystem":"Debian:13","package":"ganglia-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.5.2-1","3.5.2-2","3.5.8-1","3.5.8-2","3.5.8-3","3.5.8-3.1","3.5.8-4","3.6.1-1","3.6.1-2","3.6.1-3","3.6.1-3.1"]},{"source":"osv","ecosystem":"Debian:14","package":"ganglia-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.5.2-1","3.5.2-2","3.5.8-1","3.5.8-2","3.5.8-3","3.5.8-3.1","3.5.8-4","3.6.1-1","3.6.1-2","3.6.1-3","3.6.1-3.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"ganglia-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.6.1-1","3.6.1-1ubuntu1","3.6.1-1ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"ganglia-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.6.1-3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"ganglia-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.6.1-3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"ganglia-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.7.5+debian-3","3.7.5+debian-4"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"ganglia-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.7.5+debian-4"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"ganglia-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.7.6+debian-1.1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"ganglia-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.7.6+debian-1.1build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"ganglia-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.7.6+debian-1.1","3.7.6+debian-1.1build1"]}],"products":[{"vendor":"ganglia","product":"ganglia-web"}],"references":[{"url":"https://github.com/ganglia/ganglia-web/issues/382","tags":["Exploit","Issue Tracking","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-52762"},{"url":"https://github.com/advisories/GHSA-99p7-c89v-ph5p"},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-52762","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-52762","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-52762","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2024-52762","description":"A cross-site scripting (XSS) vulnerability in the component /master/header.php of Ganglia-web v3.73 to v3.76 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the \"tz\" parameter.","status":"published","published":"2024-11-19T00:00:00Z","modified":"2024-11-20T19:25:19.566Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:34:03.333404Z"}],"euvd":[{"id":"EUVD-2024-46044","description":"A cross-site scripting (XSS) vulnerability in the component /master/header.php of Ganglia-web v3.73 to v3.76 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the \"tz\" parameter.","status":"published","published":"2024-11-19T00:00:00Z","modified":"2024-11-20T19:25:19Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T00:04:53.318425Z"}],"ghsa":[{"id":"GHSA-99p7-c89v-ph5p","title":"A cross-site scripting (XSS) vulnerability in the component /master/header.php of Ganglia-web v3...","description":"A cross-site scripting (XSS) vulnerability in the component /master/header.php of Ganglia-web v3.73 to v3.76 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the \"tz\" parameter.","status":"published","published":"2024-11-19T21:31:33Z","modified":"2024-11-20T21:31:53Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:58:54.226272Z"}],"nvd":[{"id":"CVE-2024-52762","description":"A cross-site scripting (XSS) vulnerability in the component /master/header.php of Ganglia-web v3.73 to v3.76 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the \"tz\" parameter.","status":"published","published":"2024-11-19T21:15:06.58Z","modified":"2026-06-17T08:07:35.583Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:10:37.632431Z"}],"osv":[{"id":"CVE-2024-52762","description":"A cross-site scripting (XSS) vulnerability in the component /master/header.php of Ganglia-web v3.73 to v3.76 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the \"tz\" parameter.","status":"published","published":"2024-11-19T21:15:06.58Z","modified":"2026-04-10T05:12:21.841755Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:44.032344Z"},{"id":"DEBIAN-CVE-2024-52762","description":"A cross-site scripting (XSS) vulnerability in the component /master/header.php of Ganglia-web v3.73 to v3.76 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the \"tz\" parameter.","status":"published","published":"2024-11-19T21:15:06.58Z","modified":"2026-11-02T12:03:14.849062847Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:44.117337Z"},{"id":"UBUNTU-CVE-2024-52762","description":"A cross-site scripting (XSS) vulnerability in the component /master/header.php of Ganglia-web v3.73 to v3.76 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the \"tz\" parameter.","status":"published","published":"2024-11-19T21:15:00Z","modified":"2026-10-17T12:56:40.281721378Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"},{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:55:11.182485Z"}]}}