CVE-2018-20726

Published: Jan 16, 2019Modified: Nov 21, 2024

5.4

Vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.3 / Impact: 2.7

Source: NVD

Description

A cross-site scripting (XSS) vulnerability exists in host.php (via tree.php) in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Website Hostname field for Devices.

Affected (1)

Products: Cacti: Cacti

Cacti

1 product

Cacti

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Cacti Cacti	Before 1.2.0

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (14)

http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00001.html

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00005.html

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00042.html

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00048.html

Source: cve@mitre.org

https://github.com/Cacti/cacti/blob/develop/CHANGELOG

Source: cve@mitre.org

Release NotesThird Party Advisory

https://github.com/Cacti/cacti/commit/80c2a88fb2afb93f87703ba4641f9970478c102d

Source: cve@mitre.org

PatchThird Party Advisory

https://github.com/Cacti/cacti/issues/2213

Source: cve@mitre.org

ExploitIssue TrackingThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00001.html