#VU36233 Cross-site scripting in Cacti - CVE-2018-20724
Published: January 16, 2019 / Updated: August 8, 2020
Vulnerability identifier: #VU36233
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear
CVE-ID: CVE-2018-20724
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
Cacti
Cacti
Software vendor:
The Cacti Group, Inc.
The Cacti Group, Inc.
Description
The vulnerability allows a remote privileged user to read and manipulate data.
A cross-site scripting (XSS) vulnerability exists in pollers.php in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Website Hostname for Data Collectors.
Remediation
Install update from vendor's website.
External links
- http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00001.html
- http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00005.html
- http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00042.html
- http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00048.html
- https://github.com/Cacti/cacti/blob/develop/CHANGELOG
- https://github.com/Cacti/cacti/commit/1f42478506d83d188f68ce5ff41728a7bd159f53
- https://github.com/Cacti/cacti/issues/2212