CVE-2018-10059: XSS
Published Apr 12, 2018
·Updated
Cacti before 1.1.37 has XSS because the getcurrentpage function in lib/functions.php relies on $SERVER['PHPSELF'] instead of $SERVER['SCRIPTNAME'] to determine a page name.
Affected Software
1 affected component
Cacti Cacti<=1.1.36
Remediation
Patch Available
Event History
Apr 12, 2018
CVE Published
via MITRE·04:00 PM
Data Sourced
via MITRE·04:00 PM
Description
Frequently Asked Questions
1
What is CVE-2018-10059?
CVE-2018-10059 is a vulnerability in Cacti before version 1.1.37 that allows for XSS attacks.
2
What is the severity of CVE-2018-10059?
The severity of CVE-2018-10059 is medium with a CVSS score of 5.4.
3
How does CVE-2018-10059 work?
CVE-2018-10059 works by leveraging the get_current_page function in lib/functions.php, which relies on $_SERVER['PHP_SELF'] instead of $_SERVER['SCRIPT_NAME'], allowing for XSS attacks.
4
What software versions are affected by CVE-2018-10059?
Cacti versions up to and including 1.1.36 are affected by CVE-2018-10059.
5
How can I fix CVE-2018-10059?
To fix CVE-2018-10059, you should upgrade to Cacti version 1.1.37 or later.