Fedora EPEL 7 update for cacti, cacti-spine



| Updated: 2025-04-24
Risk Low
Patch available YES
Number of vulnerabilities 4
CVE-ID CVE-2018-20723
CVE-2018-20724
CVE-2018-20725
CVE-2018-20726
CWE-ID CWE-79
Exploitation vector Network
Public exploit N/A
Vulnerable software
 Fedora
Operating systems & Components / Operating system

cacti-spine
Operating systems & Components / Operating system package or component

cacti
Operating systems & Components / Operating system package or component

Vendor Fedoraproject

Security Bulletin

This security bulletin contains information about 4 vulnerabilities.

1) Cross-site scripting

EUVDB-ID: #VU36232

Risk: Low

CVSSv4.0: 1.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2018-20723

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

Description

The vulnerability allows a remote privileged user to read and manipulate data.

A cross-site scripting (XSS) vulnerability exists in color_templates.php in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Name field for a Color.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Fedora: 7

cacti-spine: before 1.2.0-2.el7

cacti: before 1.2.0-1.el7

CPE2.3 External links

https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2019-17b3c81533


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Cross-site scripting

EUVDB-ID: #VU36233

Risk: Low

CVSSv4.0: 1.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2018-20724

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

Description

The vulnerability allows a remote privileged user to read and manipulate data.

A cross-site scripting (XSS) vulnerability exists in pollers.php in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Website Hostname for Data Collectors.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Fedora: 7

cacti-spine: before 1.2.0-2.el7

cacti: before 1.2.0-1.el7

CPE2.3 External links

https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2019-17b3c81533


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Cross-site scripting

EUVDB-ID: #VU36234

Risk: Low

CVSSv4.0: 1.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2018-20725

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

Description

The vulnerability allows a remote privileged user to read and manipulate data.

A cross-site scripting (XSS) vulnerability exists in graph_templates.php in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Graph Vertical Label.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Fedora: 7

cacti-spine: before 1.2.0-2.el7

cacti: before 1.2.0-1.el7

CPE2.3 External links

https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2019-17b3c81533


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Cross-site scripting

EUVDB-ID: #VU36235

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2018-20726

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

Description

The vulnerability allows a remote authenticated user to read and manipulate data.

A cross-site scripting (XSS) vulnerability exists in host.php (via tree.php) in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Website Hostname field for Devices.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Fedora: 7

cacti-spine: before 1.2.0-2.el7

cacti: before 1.2.0-1.el7

CPE2.3 External links

https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2019-17b3c81533


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###