CVE-2020-7106
Fixed in a distro release EPSS 2%
Cacti 1.2.8 has stored XSS in data_sources.php, color_templates_item.php, graphs.php, graph_items.php, lib/api_automation.php, user_admin.php, and user_group_admin.php, as demonstrated by the description parameter in data_sources.php (a raw string from the database that is displayed by $header to trigger the XSS).
Products: cacti, debian_linux, opensuse backports_sle, opensuse leap, suse package_hub, fedoraproject extra_packages_for_enterprise_linux, fedoraproject fedora
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | cacti | 1.2.9+ds1-1 |
| Debian 13 | cacti | 1.2.9+ds1-1 |
| Debian 14 | cacti | 1.2.9+ds1-1 |
| Debian 8 | cacti | 0.8.8b+dfsg-8+deb8u9 |
| Debian 9 | cacti | 0.8.8h+ds1-10+deb9u2 |
| SUSE Package Hub 12 | cacti | 1.2.12-bp151.4.9.1 |
| SUSE Package Hub 12 | cacti | 1.2.11-5.1 |
| SUSE Package Hub 12 | cacti-spine | 1.2.12-bp151.4.9.1 |
| SUSE Package Hub 12 | cacti-spine | 1.2.11-2.1 |
| SUSE Package Hub 15 SP1 | cacti | 1.2.9-bp151.4.3.1 |
| SUSE Package Hub 15 SP1 | cacti | 1.2.12-bp151.4.9.1 |
| SUSE Package Hub 15 SP1 | cacti | 1.2.11-bp151.4.6.1 |
| SUSE Package Hub 15 SP1 | cacti-spine | 1.2.9-bp151.4.3.1 |
| SUSE Package Hub 15 SP1 | cacti-spine | 1.2.12-bp151.4.9.1 |
| SUSE Package Hub 15 SP1 | cacti-spine | 1.2.11-bp151.4.6.1 |
| Ubuntu Pro 14.04 LTS | cacti | 0.8.8b+dfsg-5ubuntu0.2+esm1 |
| Ubuntu Pro 16.04 LTS | cacti | no fix |
| Ubuntu Pro 18.04 LTS | cacti | no fix |
| openSUSE Leap 15.1 | cacti | 1.2.12-bp151.4.9.1 |
| openSUSE Leap 15.1 | cacti | 1.2.9-lp151.3.3.1 |
| openSUSE Leap 15.1 | cacti | 1.2.11-5.1 |
| openSUSE Leap 15.1 | cacti-spine | 1.2.9-lp151.3.3.1 |
| openSUSE Leap 15.1 | cacti-spine | 1.2.12-bp151.4.9.1 |
| openSUSE Leap 15.1 | cacti-spine | 1.2.11-2.1 |
| openSUSE Tumbleweed | cacti | 1.2.18-1.2 |