Cacti XSS vulnerability in lib/html_tree.php by reading dirty data stored in database
Résumé
Cacti XSS vulnerability in lib/html_tree.php by reading dirty data stored in database
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Cacti provides an operational monitoring and fault management framework. Prior to 1.2.27, some of the data stored in form_save() function in data_queries.php is not thoroughly checked and is used to concatenate the HTML statement in grow_right_pane_tree() function from lib/html.php , finally resulting in cross-site scripting. Version 1.2.27 contains a patch for the issue.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Debian DEBIAN-CVE-2024-31443 cacti Corrigé dans: 1.2.16+ds1-2+deb11u4
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- web lists.debian.org
- web lists.fedoraproject.org