CVE-2019-11025: XSS
Published Apr 8, 2019
·Updated
In clearFilter() in utilities.php in Cacti before 1.2.3, no escaping occurs before printing out the value of the SNMP community string (SNMP Options) in the View poller cache, leading to XSS.
Affected Software
3 affected components
Cacti Cacti<1.2.3
Debian Debian Linux=8.0
Debian Debian Linux=9.0
Event History
Apr 8, 2019
CVE Published
via MITRE·10:20 PM
Data Sourced
via MITRE·10:20 PM
Description
Frequently Asked Questions
1
What is CVE-2019-11025?
CVE-2019-11025 is a vulnerability in Cacti before 1.2.3 that allows for XSS attacks.
2
How severe is CVE-2019-11025?
CVE-2019-11025 has a severity score of 5.4 (medium).
3
Which software versions are affected by CVE-2019-11025?
The Cacti version up to exclusive 1.2.3 and Debian Linux versions 8.0 and 9.0 are affected by CVE-2019-11025.
4
How can I fix CVE-2019-11025?
To fix CVE-2019-11025, update Cacti to version 1.2.3 or later.
5
What is the CWE classification of CVE-2019-11025?
CVE-2019-11025 is classified under CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').