Cross-site scripting in Cacti - CVE-2018-20726

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU36235

Cross-site scripting in Cacti - CVE-2018-20726

Published: January 16, 2019 / Updated: August 8, 2020


Vulnerability identifier: #VU36235
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2018-20726
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote authenticated user to read and manipulate data.

A cross-site scripting (XSS) vulnerability exists in host.php (via tree.php) in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Website Hostname field for Devices.


Affected software

Cacti
Fedora
SUSE Linux
Opensuse
SUSE Package Hub for SUSE Linux Enterprise
cacti
cacti-spine

How to mitigate CVE-2018-20726

Install update from vendor's website.

Cacti - update to 1.2.0
cacti - addressed in versions 1.2.0-1.el7, 1.2.2-1.el7
cacti-spine - addressed in versions 1.2.0-2.el7, 1.2.2-1.el7

External References

Related Security Bulletins