XSS in Cacti
CVE-2019-11025
In clearFilter() in utilities.php in Cacti before 1.2.3, no escaping occurs before printing out the value of the SNMP community string (SNMP Options) in the View poller cache, leading to XSS.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.013 (68.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N.
Affected products
- Cacti
- Debian Debian_linux — versions 8.0, 9.0
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (Exploit, Third Party Advisory, x_refsource_MISC, Issue Tracking)
- cve@mitre.org (Third Party Advisory, x_refsource_MISC, Release Notes)
- cve@mitre.org (mailing-list, x_refsource_MLIST, Mailing List, Third Party Advisory)
- cve@mitre.org (mailing-list, x_refsource_MLIST, Mailing List, Third Party Advisory)
Frequently asked questions
- What is CVE-2019-11025?
- CVE-2019-11025 is a medium-severity vulnerability in Cacti, classified under Cross-site Scripting. CVSS score: 5.4/10. Published 2019-04-08.
- How severe is CVE-2019-11025?
- Medium severity. CVSS v3 base score is 5.4 out of 10.