Cacti CVE-2017-12066 Incomplete Fix Cross Site Scripting Vulnerability
BID:100322
Info
Cacti CVE-2017-12066 Incomplete Fix Cross Site Scripting Vulnerability
| Bugtraq ID: | 100322 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Aug 01 2017 12:00AM |
| Updated: | Aug 01 2017 12:00AM |
| Credit: | kevinoclam |
| Vulnerable: |
Planet Technology WSW-2401 0.8.6 h Planet Technology WSW-2401 0.8.6 g Cacti Cacti 1.1.14 Cacti Cacti 1.1.11 Cacti Cacti 1.1.10 Cacti Cacti 1.1 Cacti Cacti 0.8.7 Cacti Cacti 0.8.6 f Cacti Cacti 0.8.6 c Cacti Cacti 0.8.5 a Cacti Cacti 0.8.5 Cacti Cacti 0.8.4 Cacti Cacti 0.8.3 a Cacti Cacti 0.8.3 Cacti Cacti 0.8.2 a Cacti Cacti 0.8.2 Cacti Cacti 0.8.1 Cacti Cacti 0.8 Cacti Cacti 0.6.7 Cacti Cacti 1.1.15 Cacti Cacti 1.1.13 Cacti Cacti 1.1.12 Cacti Cacti 1.0 Cacti Cacti 0.8.8g Cacti Cacti 0.8.8f Cacti Cacti 0.8.8e Cacti Cacti 0.8.8d Cacti Cacti 0.8.8c Cacti Cacti 0.8.8b Cacti Cacti 0.8.8a Cacti Cacti 0.8.8 Cacti Cacti 0.8.7i Cacti Cacti 0.8.7h Cacti Cacti 0.8.7g Cacti Cacti 0.8.7f Cacti Cacti 0.8.7e Cacti Cacti 0.8.7d Cacti Cacti 0.8.7c Cacti Cacti 0.8.7b Cacti Cacti 0.8.7a Cacti Cacti 0.8.6k Cacti Cacti 0.8.6j Cacti Cacti 0.8.6i Cacti Cacti 0.8.6F Cacti Cacti 0.8.6E |
| Not Vulnerable: |
Cacti Cacti 1.1.16 |
Discussion
Cacti CVE-2017-12066 Incomplete Fix Cross Site Scripting Vulnerability
Cacti is prone to a cross-site scripting vulnerability because it fails to sanitize user-supplied input.
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.
Cacti 1.1.15 and prior are vulnerable.
Cacti is prone to a cross-site scripting vulnerability because it fails to sanitize user-supplied input.
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.
Cacti 1.1.15 and prior are vulnerable.
Exploit / POC
Cacti CVE-2017-12066 Incomplete Fix Cross Site Scripting Vulnerability
An attacker can exploit this issue by enticing an unsuspecting user into visiting a specially crafted URL.
An attacker can exploit this issue by enticing an unsuspecting user into visiting a specially crafted URL.
Solution / Fix
Cacti CVE-2017-12066 Incomplete Fix Cross Site Scripting Vulnerability
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.