CVE-2019-11025
Fixed in a distro release EPSS 1%
In clearFilter() in utilities.php in Cacti before 1.2.3, no escaping occurs before printing out the value of the SNMP community string (SNMP Options) in the View poller cache, leading to XSS.
Products: cacti, debian_linux
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | cacti | 1.2.2+ds1-2 |
| Debian 13 | cacti | 1.2.2+ds1-2 |
| Debian 14 | cacti | 1.2.2+ds1-2 |
| Debian 8 | cacti | 0.8.8b+dfsg-8+deb8u7 |
| Debian 9 | cacti | 0.8.8h+ds1-10+deb9u2 |
| Ubuntu Pro 14.04 LTS | cacti | 0.8.8b+dfsg-5ubuntu0.2+esm1 |
| Ubuntu Pro 16.04 LTS | cacti | no fix |
| Ubuntu Pro 18.04 LTS | cacti | no fix |