CVEvulnerability
CVE-2019-11025
5.4 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2019-04-08
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 5.4 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- CVSS 2.0 ([email protected])
- 3.5 LOW — AV:N/AC:M/Au:S/C:N/I:P/A:N
- Weaknesses
- CWE-79
Description
In clearFilter() in utilities.php in Cacti before 1.2.3, no escaping occurs before printing out the value of the SNMP community string (SNMP Options) in the View poller cache, leading to XSS.
Affected configurations
• cacti cacti (< 1.2.3)
• debian debian linux 8.0
• debian debian linux 9.0
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- https://github.com/Cacti/cacti/compare/6ea486a...99995bb Release Notes, Third Party Advisory
- https://github.com/Cacti/cacti/issues/2581 Exploit, Issue Tracking, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2019/04/msg00017.html Mailing List, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2022/03/msg00038.html Mailing List, Third Party Advisory
- https://github.com/Cacti/cacti/compare/6ea486a...99995bb Release Notes, Third Party Advisory
- https://github.com/Cacti/cacti/issues/2581 Exploit, Issue Tracking, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2019/04/msg00017.html Mailing List, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2022/03/msg00038.html Mailing List, Third Party Advisory