Cacti CVE-2015-2665 HTML Injection Vulnerability

Bugtraq ID:	75309
Class:	Input Validation Error
CVE:	CVE-2015-2665
Remote:	Yes
Local:	No
Published:	Jun 19 2015 12:00AM
Updated:	Jul 15 2015 12:45AM
Credit:	Fortinet's FortiGuard Labs
Vulnerable:	Planet Technology WSW-2401 0.8.6 h Planet Technology WSW-2401 0.8.6 g Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64 Cacti Cacti 0.8.7 Cacti Cacti 0.8.6 f Cacti Cacti 0.8.6 c Cacti Cacti 0.8.5 a Cacti Cacti 0.8.5 Cacti Cacti 0.8.4 Cacti Cacti 0.8.3 a Cacti Cacti 0.8.3 Cacti Cacti 0.8.2 a Cacti Cacti 0.8.2 Cacti Cacti 0.8.1 Cacti Cacti 0.8 Cacti Cacti 0.6.7 Cacti Cacti 0.8.7i Cacti Cacti 0.8.7h Cacti Cacti 0.8.7g Cacti Cacti 0.8.7f Cacti Cacti 0.8.7e Cacti Cacti 0.8.7d Cacti Cacti 0.8.7c Cacti Cacti 0.8.7b Cacti Cacti 0.8.7a Cacti Cacti 0.8.6k Cacti Cacti 0.8.6j Cacti Cacti 0.8.6i
Not Vulnerable:

Cacti CVE-2015-2665 HTML Injection Vulnerability

Cacti is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input.

Attacker-supplied HTML and script code would run in the context of the affected website, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user.

Cacti CVE-2015-2665 HTML Injection Vulnerability

An attacker can exploit this issue through a browser.

Cacti CVE-2015-2665 HTML Injection Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Cacti CVE-2015-2665 HTML Injection Vulnerability

References:

• Cacti Homepage (Cacti)
  
• Release Notes - 0.8.8d (Cacti)
  
• Fortinet Discovers Cacti Cross-Site Scripting (XSS) Vulnerability (Fortinet)