Cross-site scripting (XSS) vulnerability in aggregate_graphs.php in Cacti 1.1.12 allows remote authenticated users to inject arbitrary web script or HTML via specially crafted HTTP Referer headers, related to the $cancel_url variable.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Cross-site scripting (XSS) vulnerability in link.php in Cacti 1.1.12 allows remote anonymous users to
    inject arbitrary web script or HTML via the id parameter, related to the die_html_input_error function in
    lib/html_validate.php. (CVE-2017-10970)

  - Cross-site scripting (XSS) vulnerability in aggregate_graphs.php in Cacti 1.1.12 allows remote
    authenticated users to inject arbitrary web script or HTML via specially crafted HTTP Referer headers,
    related to the $cancel_url variable. (CVE-2017-11163)

  - Cross-site scripting (XSS) vulnerability in auth_profile.php in Cacti 1.1.13 allows remote attackers to
    inject arbitrary web script or HTML via specially crafted HTTP Referer headers. (CVE-2017-11691)

  - spikekill.php in Cacti before 1.1.16 might allow remote attackers to execute arbitrary code via the
    avgnan, outlier-start, or outlier-end parameter. (CVE-2017-12065)

  - Cross-site scripting (XSS) vulnerability in aggregate_graphs.php in Cacti before 1.1.16 allows remote
    authenticated users to inject arbitrary web script or HTML via specially crafted HTTP Referer headers,
    related to the $cancel_url variable. NOTE: this vulnerability exists because of an incomplete fix (lack of
    the htmlspecialchars ENT_QUOTES flag) for CVE-2017-11163. (CVE-2017-12066)

This update for cacti, cacti-spine fixes the following issues :

  - CVE-2017-12065: Possible code execution via avgnan,     outlier-start, or outlier-end parameter (bsc#1051633)

  - CVE-2017-11691: XSS in auth_profile.php allows remote     attackers to inject arbitrary JS via specially crafted     HTTP Referer headers (bsc#1050950)

  - CVE-2017-10970: XSS Issue in link.php bsc#1047512

  - CVE-2017-11163: XSS Issue in lib/html_form.php     bsc#1048102

In addition, cacti and cacti-spine were updated to the current stable release 1.1.16, containing all upstream improvements and bugfixes.

ID	Name	Product	Family	Severity
400822	Alpine: multiple cacti packages: security update to 1.1.13-r0 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
400822	Alpine: multiple cacti packages: security update to 1.1.13-r0 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
102249	openSUSE Security Update : cacti / cacti-spine (openSUSE-2017-889)	Nessus	SuSE Local Security Checks	critical

Detections

Analytics

CVE-2017-11163

medium

Tenable Plugins

critical

critical

critical