Lucene search

AmazonALAS-2017-923

HistoryNov 15, 2017 - 7:56 p.m.

Medium: cacti

2017-11-1519:56:00

alas.aws.amazon.com

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

39.8%

JSON

Issue Overview:

include/global_session.php in Cacti 1.1.25 has XSS related to (1) the URI or (2) the refresh page. (CVE-2017-15194)

Affected Packages:

cacti

Issue Correction:
Run yum update cacti to update your system.

New Packages:

noarch:  
    cacti-1.1.19-2.18.amzn1.noarch  
  
src:  
    cacti-1.1.19-2.18.amzn1.src

Additional References

Red Hat: CVE-2017-15194

Mitre: CVE-2017-15194

OSVersionArchitecturePackageVersionFilename
Amazon Linux1noarchcacti< 1.1.19-2.18.amzn1cacti-1.1.19-2.18.amzn1.noarch.rpm

OS	Version	Architecture	Package	Version	Filename
Amazon Linux	1	noarch	cacti	< 1.1.19-2.18.amzn1	cacti-1.1.19-2.18.amzn1.noarch.rpm

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

39.8%

JSON

Related for ALAS-2017-923