Cross-site scripting in Cacti - CVE-2018-20724

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU36233

Cross-site scripting in Cacti - CVE-2018-20724

Published: January 16, 2019 / Updated: August 8, 2020


Vulnerability identifier: #VU36233
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2018-20724
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote privileged user to read and manipulate data.

A cross-site scripting (XSS) vulnerability exists in pollers.php in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Website Hostname for Data Collectors.


Affected software

Cacti
Fedora
SUSE Linux
Opensuse
SUSE Package Hub for SUSE Linux Enterprise
cacti
cacti-spine

How to mitigate CVE-2018-20724

Install update from vendor's website.

Cacti - update to 1.2.0
cacti - addressed in versions 1.2.0-1.el7, 1.2.2-1.el7
cacti-spine - addressed in versions 1.2.0-2.el7, 1.2.2-1.el7

External References

Related Security Bulletins