PT-2017-12331 · Cacti+1 · Cacti+1

Kevinoclamo · Publicado 2017-08-01 · Atualizado 2019-01-05 · CVE-2017-12066

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Cacti versions prior to 1.1.16

Description A cross-site scripting (XSS) issue exists, allowing remote authenticated users to inject arbitrary web script or HTML via specially crafted HTTP Referer headers, related to the cancel url variable. This issue is due to an incomplete fix that lacked the htmlspecialchars ENT QUOTES flag.

Recommendations For versions prior to 1.1.16, update to version 1.1.16 or later to resolve the issue. As a temporary workaround, consider restricting access to the aggregate graphs.php file until a patch is applied. Avoid using specially crafted HTTP Referer headers in the affected cancel url variable until the issue is resolved.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

ALT-PU-2019-1006

CVE-2017-12066

MGASA-2017-0267

Produtos afetados

Alt Linux

Cacti

Referências · 18

• https://github.com/Cacti/cacti/issues/877 · Correção
• https://github.com/Cacti/cacti/commit/bd0e586f6f46d814930226f1516a194e7e72293e · Correção
• https://osv.dev/vulnerability/CVE-2017-12066 · Aviso do Fabricante
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/QN75M6HGIKEEX7HYFWHIO6IYDB5RXFP6 · Aviso do Fabricante
• https://lists.opensuse.org/opensuse-updates/2017-08/msg00018.html · Nota
• https://ubuntu.com/security/CVE-2017-12066 · Aviso do Fabricante
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/7MRJCGVNDLW7RCTYSL72XGP74PCMOIH2 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-12066 · Aviso do Fabricante
• https://osv.dev/vulnerability/MGASA-2017-0267 · Aviso do Fabricante
• https://bugs.mageia.org/show_bug.cgi?id=21242 · Nota
• https://advisories.mageia.org/MGASA-2017-0267.html · Nota de Segurança
• https://cacti.net/release_notes.php?version=1.1.16 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-12066 · Nota de Segurança
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-12066 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2017-12066 · Nota de Segurança