Vulnerability Description
A cross-site scripting (XSS) vulnerability exists in pollers.php in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Website Hostname for Data Collectors.
CVSS Score
4.8
MEDIUM
CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Cacti | Cacti | < 1.2.0 |
Related Weaknesses (CWE)
References
- http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00001.html
- http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00005.html
- http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00042.html
- http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00048.html
- https://github.com/Cacti/cacti/blob/develop/CHANGELOGRelease NotesThird Party Advisory
- https://github.com/Cacti/cacti/commit/1f42478506d83d188f68ce5ff41728a7bd159f53PatchThird Party Advisory
- https://github.com/Cacti/cacti/issues/2212ExploitIssue TrackingThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00001.html
- http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00005.html
- http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00042.html
- http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00048.html
- https://github.com/Cacti/cacti/blob/develop/CHANGELOGRelease NotesThird Party Advisory
- https://github.com/Cacti/cacti/commit/1f42478506d83d188f68ce5ff41728a7bd159f53PatchThird Party Advisory
- https://github.com/Cacti/cacti/issues/2212ExploitIssue TrackingThird Party Advisory
FAQ
What is CVE-2018-20724?
CVE-2018-20724 is a vulnerability with a CVSS score of 4.8 (MEDIUM). A cross-site scripting (XSS) vulnerability exists in pollers.php in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Website Hostname for Data Collectors.
How severe is CVE-2018-20724?
CVE-2018-20724 has been rated MEDIUM with a CVSS base score of 4.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2018-20724?
Check the references section above for vendor advisories and patch information. Affected products include: Cacti Cacti.