CVE-2018-20724: XSS
A cross-site scripting (XSS) vulnerability exists in pollers.php in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Website Hostname for Data Collectors.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2018-20724?
CVE-2018-20724 is a cross-site scripting (XSS) vulnerability that exists in pollers.php in Cacti before version 1.2.0 due to lack of escaping of unintended characters in the Website Hostname for Data Collectors.
How does the XSS vulnerability in pollers.php affect Cacti?
The XSS vulnerability in pollers.php allows attackers to inject malicious scripts into the Website Hostname for Data Collectors, potentially leading to the execution of unauthorized code or the theft of sensitive information.
What is the severity of CVE-2018-20724?
The severity of CVE-2018-20724 is medium with a CVSS score of 4.8.
How can I fix the XSS vulnerability in Cacti?
To fix the XSS vulnerability in Cacti, upgrade to version 1.2.0 or later, which includes the necessary escaping of unintended characters in the Website Hostname for Data Collectors.
What is CWE-79?
CWE-79 is a common weakness enumeration category for cross-site scripting (XSS) vulnerabilities, which are caused by improperly validated or sanitized user input being included in web pages.