CVE-2017-11163: XSS

Published Jul 10, 2017

Updated

Cross-site scripting (XSS) vulnerability in aggregategraphs.php in Cacti 1.1.12 allows remote authenticated users to inject arbitrary web script or HTML via specially crafted HTTP Referer headers, related to the $cancelurl variable.

Affected Software

1 affected component

Cacti Cacti=1.1.12

Remediation

Patch Available

https://github.com/Cacti/cacti/issues/847

Event History

Jul 10, 2017

CVE Published

via MITRE·06:00 PM

Data Sourced

via MITRE·06:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2017-11163?

CVE-2017-11163 has been classified as a moderate severity cross-site scripting (XSS) vulnerability.

How do I fix CVE-2017-11163?

To remediate CVE-2017-11163, upgrade to a patched version of Cacti that does not include this vulnerability.

Who is affected by CVE-2017-11163?

CVE-2017-11163 affects users of Cacti version 1.1.12 who are authenticated and can manipulate HTTP Referer headers.

What are the potential impacts of CVE-2017-11163?

Exploitation of CVE-2017-11163 allows attackers to inject arbitrary web scripts or HTML, potentially compromising user sessions.

Is CVE-2017-11163 part of a broader set of vulnerabilities in Cacti?

CVE-2017-11163 highlights a specific cross-site scripting issue, but users should review other advisories for comprehensive security.