CVE-2017-12066

2017-08-0105:29:00

Debian Security Bug Tracker

security-tracker.debian.org

0.001 Low

EPSS

Percentile

40.2%

JSON

Cross-site scripting (XSS) vulnerability in aggregate_graphs.php in Cacti before 1.1.16 allows remote authenticated users to inject arbitrary web script or HTML via specially crafted HTTP Referer headers, related to the $cancel_url variable. NOTE: this vulnerability exists because of an incomplete fix (lack of the htmlspecialchars ENT_QUOTES flag) for CVE-2017-11163.

OSVersionArchitecturePackageVersionFilename
Debian12allcacti< 1.1.16+ds1-1cacti_1.1.16+ds1-1_all.deb
Debian11allcacti< 1.1.16+ds1-1cacti_1.1.16+ds1-1_all.deb
Debian10allcacti< 1.1.16+ds1-1cacti_1.1.16+ds1-1_all.deb
Debian999allcacti< 1.1.16+ds1-1cacti_1.1.16+ds1-1_all.deb
Debian13allcacti< 1.1.16+ds1-1cacti_1.1.16+ds1-1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	cacti	< 1.1.16+ds1-1	cacti_1.1.16+ds1-1_all.deb
Debian	11	all	cacti	< 1.1.16+ds1-1	cacti_1.1.16+ds1-1_all.deb
Debian	10	all	cacti	< 1.1.16+ds1-1	cacti_1.1.16+ds1-1_all.deb
Debian	999	all	cacti	< 1.1.16+ds1-1	cacti_1.1.16+ds1-1_all.deb
Debian	13	all	cacti	< 1.1.16+ds1-1	cacti_1.1.16+ds1-1_all.deb

0.001 Low

EPSS

Percentile

40.2%

JSON

Related for DEBIANCVE:CVE-2017-12066