CVE-2018-20724

A cross-site scripting (XSS) vulnerability exists in pollers.php in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Website Hostname for Data Collectors.

Score

CVSS 3.0 4.8 Medium

Status

Modified - cve@mitre.org

Published

2019-01-16

Last modified

2024-08-05

Weaknesses

CWE-79

Affected products

• Cacti (Cacti)

References

• http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00001.html
• http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00005.html
• http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00042.html
• http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00048.html
• https://github.com/Cacti/cacti/blob/develop/CHANGELOG
• https://github.com/Cacti/cacti/commit/1f42478506d83d188f68ce5ff41728a7bd159f53
• https://github.com/Cacti/cacti/issues/2212