PT-2022-36634 · Cacti+1 · Cacti+1
Published
2022-10-30
·
Updated
2022-10-30
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
Name of the Vulnerable Software and Affected Versions
cacti versions prior to 1.2.22
cacti-spine versions prior to 1.2.22
Description
The issue is related to a cross-site injection vulnerability that can occur when creating new graphs. This vulnerability can be exploited when the
boo#1203952 condition is met. Additionally, there are several bug fixes and improvements, including fixes for issues with user template creation, graph template items, and database SSL settings. There is no information about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited.Recommendations
For cacti versions prior to 1.2.22, update to version 1.2.22 or later to resolve the issue.
For cacti-spine versions prior to 1.2.22, update to version 1.2.22 or later to resolve the issue.
As a temporary workaround, consider restricting access to the graph creation feature until a patch is available.
Avoid using the vulnerable graph creation feature until the issue is resolved.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Cacti
Cacti-Spine