Lucene search

AmazonALAS-2017-904

HistoryOct 02, 2017 - 4:54 p.m.

Medium: cacti

2017-10-0216:54:00

alas.aws.amazon.com

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

0.009 Low

EPSS

Percentile

82.9%

JSON

Issue Overview:

A cross-site scripting vulnerability exists in Cacti in the method parameter in spikekill.php. (CVE-2017-12927)

The lib/html.php script in Cacti has a XSS vulnerability via the title field of an external link added by an authenticated user. (CVE-2017-12978)

Affected Packages:

cacti

Issue Correction:
Run yum update cacti to update your system.

New Packages:

noarch:  
    cacti-1.1.19-1.17.amzn1.noarch  
  
src:  
    cacti-1.1.19-1.17.amzn1.src

Additional References

Red Hat: CVE-2017-12927, CVE-2017-12978

Mitre: CVE-2017-12927, CVE-2017-12978

OSVersionArchitecturePackageVersionFilename
Amazon Linux1noarchcacti< 1.1.19-1.17.amzn1cacti-1.1.19-1.17.amzn1.noarch.rpm

OS	Version	Architecture	Package	Version	Filename
Amazon Linux	1	noarch	cacti	< 1.1.19-1.17.amzn1	cacti-1.1.19-1.17.amzn1.noarch.rpm

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

0.009 Low

EPSS

Percentile

82.9%

JSON

Related for ALAS-2017-904