Cross-Site Scripting

2024-05-2002:38:48

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

cacti

cross-site scripting

vulnerability

data validation

data_queries.php

html statement

html.php

CVSS3

5.7

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H

AI Score

6.6

Confidence

High

JSON

Cacti is vulnerable to Cross-site scripting. The vulnerability is due to insufficient data validation in the form_save function in data_queries.php, which is used to concatenate the HTML statement in the grow_right_pane_tree function from html.php.