Cross-site scripting in Cacti - CVE-2018-20725

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU36234

Cross-site scripting in Cacti - CVE-2018-20725

Published: January 16, 2019 / Updated: August 8, 2020


Vulnerability identifier: #VU36234
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2018-20725
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote privileged user to read and manipulate data.

A cross-site scripting (XSS) vulnerability exists in graph_templates.php in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Graph Vertical Label.


Affected software

Cacti
Fedora
SUSE Linux
Opensuse
SUSE Package Hub for SUSE Linux Enterprise
cacti
cacti-spine

How to mitigate CVE-2018-20725

Install update from vendor's website.

Cacti - update to 1.2.0
cacti - addressed in versions 1.2.0-1.el7, 1.2.2-1.el7
cacti-spine - addressed in versions 1.2.0-2.el7, 1.2.2-1.el7

External References

Related Security Bulletins