Vulnerability Description
A cross-site scripting (XSS) vulnerability exists in host.php (via tree.php) in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Website Hostname field for Devices.
CVSS Score
5.4
MEDIUM
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Cacti | Cacti | < 1.2.0 |
Related Weaknesses (CWE)
References
- http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00001.html
- http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00005.html
- http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00042.html
- http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00048.html
- https://github.com/Cacti/cacti/blob/develop/CHANGELOGRelease NotesThird Party Advisory
- https://github.com/Cacti/cacti/commit/80c2a88fb2afb93f87703ba4641f9970478c102dPatchThird Party Advisory
- https://github.com/Cacti/cacti/issues/2213ExploitIssue TrackingThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00001.html
- http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00005.html
- http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00042.html
- http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00048.html
- https://github.com/Cacti/cacti/blob/develop/CHANGELOGRelease NotesThird Party Advisory
- https://github.com/Cacti/cacti/commit/80c2a88fb2afb93f87703ba4641f9970478c102dPatchThird Party Advisory
- https://github.com/Cacti/cacti/issues/2213ExploitIssue TrackingThird Party Advisory
FAQ
What is CVE-2018-20726?
CVE-2018-20726 is a vulnerability with a CVSS score of 5.4 (MEDIUM). A cross-site scripting (XSS) vulnerability exists in host.php (via tree.php) in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Website Hostname field for Devices.
How severe is CVE-2018-20726?
CVE-2018-20726 has been rated MEDIUM with a CVSS base score of 5.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2018-20726?
Check the references section above for vendor advisories and patch information. Affected products include: Cacti Cacti.