Cacti XSS vulnerability in lib/html.php by reading dirty data stored in database
Résumé
Cacti XSS vulnerability in lib/html.php by reading dirty data stored in database
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, some of the data stored in automation_tree_rules_form_save() function in automation_tree_rules.php is not thoroughly checked and is used to concatenate the HTML statement in form_confirm() function from lib/html.php , finally resulting in cross-site scripting. Version 1.2.27 contains a patch for the issue.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Debian DEBIAN-CVE-2024-31444 cacti Corrigé dans: 1.2.16+ds1-2+deb11u4
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- web lists.debian.org
- web lists.fedoraproject.org