XSS in Cacti

CVE-2013-5588

Multiple cross-site scripting (XSS) vulnerabilities in Cacti 0.8.8b and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the step parameter to install/index.php or (2) the id parameter to cacti/host.php.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.012 (66.1th percentile) — read the EPSS interpretation.

Affected products

  • Cacti — versions 0.8, 0.8.1, 0.8.2
  • Opensuse — versions 13.1, 13.2
  • N/a — versions n/a

Weakness classification (CWE)

References