CVE-2020-7106
16.01.2020, 04:15
Cacti 1.2.8 has stored XSS in data_sources.php, color_templates_item.php, graphs.php, graph_items.php, lib/api_automation.php, user_admin.php, and user_group_admin.php, as demonstrated by the description parameter in data_sources.php (a raw string from the database that is displayed by $header to trigger the XSS).
Cross-site Scripting
| Vendor | Product | Version |
|---|---|---|
| cacti | cacti | 𝑥 < 1.2.9 |
| debian | debian_linux | 8.0 |
| debian | debian_linux | 9.0 |
| opensuse | backports_sle | 15.0 |
| opensuse | leap | 15.1 |
| suse | package_hub | - |
| fedoraproject | extra_packages_for_enterprise_linux | 7.0 |
| fedoraproject | extra_packages_for_enterprise_linux | 8.0 |
| fedoraproject | extra_packages_for_enterprise_linux | 9.0 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
References