CVE-2017-12066 — Cross-site Scripting in Cacti

CWE-79 — Cross-site Scripting7 documents5 sources
Severity
5.4MEDIUMNVD
EPSS
0.2%
top 52.69%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
CactiDebian Cacti
Timeline
PublishedAug 1
Latest updateMay 17

Description

Cross-site scripting (XSS) vulnerability in aggregate_graphs.php in Cacti before 1.1.16 allows remote authenticated users to inject arbitrary web script or HTML via specially crafted HTTP Referer headers, related to the $cancel_url variable. NOTE: this vulnerability exists because of an incomplete fix (lack of the htmlspecialchars ENT_QUOTES flag) for CVE-2017-11163.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NExploitability: 2.3 | Impact: 2.7

Affected Packages3 packages

▶debiandebian/cacti< cacti 1.1.16+ds1-1 (bookworm)
▶Debiancacti/cacti< 1.1.16+ds1-1+3
▶NVDcacti/cacti1.1.15

Patches

Patch: github.com ↗Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-pg8m-2xhv-qj2g: Cross-site scripting (XSS) vulnerability in aggregate_graphs↗2022-05-17
▶
OSV
CVE-2017-12066: Cross-site scripting (XSS) vulnerability in aggregate_graphs↗2017-08-01
▶

📋Vendor Advisories

1
Debian
CVE-2017-12066: cacti - Cross-site scripting (XSS) vulnerability in aggregate_graphs.php in Cacti before...↗2017
▶

💬Community

3
Bugzilla
CVE-2017-12065 CVE-2017-12066 cacti: various flaws [epel-all]↗2017-08-01
▶
Bugzilla
CVE-2017-12066 cacti: XSS vulnerability in aggregate_graphs.php↗2017-08-01
▶
Bugzilla
CVE-2017-12065 CVE-2017-12066 cacti: various flaws [fedora-all]↗2017-08-01
▶