CVE-2017-11163 — Cross-site Scripting in Cacti

CWE-79 — Cross-site Scripting12 documents5 sources
Severity
5.4MEDIUMNVD
EPSS
0.2%
top 55.08%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
CactiDebian Cacti
Timeline
PublishedJul 10
Latest updateMay 17

Description

Cross-site scripting (XSS) vulnerability in aggregate_graphs.php in Cacti 1.1.12 allows remote authenticated users to inject arbitrary web script or HTML via specially crafted HTTP Referer headers, related to the $cancel_url variable.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NExploitability: 2.3 | Impact: 2.7

Affected Packages3 packages

▶debiandebian/cacti< cacti 1.1.12+ds1-1 (bookworm)+1
▶Debiancacti/cacti< 1.1.16+ds1-1+7
▶NVDcacti/cacti1.1.15+1

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

4
GHSA
GHSA-pg8m-2xhv-qj2g: Cross-site scripting (XSS) vulnerability in aggregate_graphs↗2022-05-17
▶
GHSA
GHSA-pv4g-wvg2-f292: Cross-site scripting (XSS) vulnerability in aggregate_graphs↗2022-05-14
▶
OSV
CVE-2017-12066: Cross-site scripting (XSS) vulnerability in aggregate_graphs↗2017-08-01
▶
OSV
CVE-2017-11163: Cross-site scripting (XSS) vulnerability in aggregate_graphs↗2017-07-10
▶

📋Vendor Advisories

2
Debian
CVE-2017-11163: cacti - Cross-site scripting (XSS) vulnerability in aggregate_graphs.php in Cacti 1.1.12...↗2017
▶
Debian
CVE-2017-12066: cacti - Cross-site scripting (XSS) vulnerability in aggregate_graphs.php in Cacti before...↗2017
▶

💬Community

4
Bugzilla
CVE-2017-12066 cacti: XSS vulnerability in aggregate_graphs.php↗2017-08-01
▶
Bugzilla
CVE-2017-11163 cacti: XSS in aggregate_graphs.php↗2017-07-12
▶
Bugzilla
CVE-2017-11163 cacti: XSS in aggregate_graphs.php [epel-all]↗2017-07-12
▶
Bugzilla
CVE-2017-11163 cacti: XSS in aggregate_graphs.php [fedora-all]↗2017-07-12
▶