Vulnerability CVE-2018-20726

Vulnerability Name:

CVE-2018-20726 (CCN-155664)

Assigned:

2019-01-16

Published:

2019-01-16

Updated:

2020-03-01

Summary:

A cross-site scripting (XSS) vulnerability exists in host.php (via tree.php) in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Website Hostname field for Devices.

CVSS v3 Severity:

5.4 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
5.2 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:H/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): Low User Interaction (UI): Required
Scope:	Scope (S): Changed
Impact Metrics:	Confidentiality (C): Low Integrity (I): Low Availibility (A): None

6.1 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
5.8 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:H/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): Required
Scope:	Scope (S): Changed
Impact Metrics:	Confidentiality (C): Low Integrity (I): Low Availibility (A): None

CVSS v2 Severity:

3.5 Low (CVSS v2 Vector: AV:N/AC:M/Au:S/C:N/I:P/A:N)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Authentication (Au): Single_Instance
Impact Metrics:	Confidentiality (C): None Integrity (I): Partial Availibility (A): None

5.5 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:N)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): Single_Instance
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): None

Vulnerability Type:

CWE-79

Vulnerability Consequences:

Cross-Site Scripting

References:

Source: MITRE
Type: CNA
CVE-2018-20726

Source: SUSE
Type: UNKNOWN
openSUSE-SU-2020:0272

Source: SUSE
Type: UNKNOWN
openSUSE-SU-2020:0284

Source: SUSE
Type: UNKNOWN
openSUSE-SU-2020:0558

Source: SUSE
Type: UNKNOWN
openSUSE-SU-2020:0565

Source: XF
Type: UNKNOWN
cacti-cve201820726-xss(155664)

Source: CCN
Type: Cacti GIT Repository
cacti/CHANGELOG at develop · Cacti/cacti · GitHub

Source: MISC
Type: Release Notes, Third Party Advisory
https://github.com/Cacti/cacti/blob/develop/CHANGELOG

Source: MISC
Type: Patch, Third Party Advisory
https://github.com/Cacti/cacti/commit/80c2a88fb2afb93f87703ba4641f9970478c102d

Source: MISC
Type: Exploit, Issue Tracking, Third Party Advisory
https://github.com/Cacti/cacti/issues/2213

Source: CCN
Type: Cacti Web site
Cacti - The Complete RRDTool-based Graphing Solution

Source: CCN
Type: WhiteSource Vulnerability Database
CVE-2018-20726

Vulnerable Configuration:

Configuration 1:

cpe:/a:cacti:cacti:*:*:*:*:*:*:*:* (Version < 1.2.0)

Configuration CCN 1:

cpe:/a:cacti:cacti:1.1.38:*:*:*:*:*:*:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:org.opensuse.security:def:201820726	V	CVE-2018-20726	2022-06-30
oval:org.opensuse.security:def:112039	P	cacti-1.2.18-1.2 on GA media (Moderate)	2022-01-17
oval:org.opensuse.security:def:64643	P	Security update for kernel-firmware (Low)	2021-12-30
oval:org.opensuse.security:def:74745	P	Security update for the Linux Kernel (Important)	2021-11-16
oval:org.opensuse.security:def:64585	P	Security update for libcryptopp (Moderate)	2021-10-06
oval:org.opensuse.security:def:105594	P	cacti-1.2.18-1.2 on GA media (Moderate)	2021-10-01
oval:org.opensuse.security:def:63246	P	xen-4.12.0_12-1.1 on GA media (Moderate)	2021-09-21
oval:org.opensuse.security:def:64755	P	Security update for spectre-meltdown-checker (Moderate)	2021-08-27
oval:org.opensuse.security:def:64558	P	Security update for fetchmail (Moderate)	2021-08-20
oval:org.opensuse.security:def:93574	P	(Important)	2021-08-12
oval:org.opensuse.security:def:63449	P	postgresql-test-12-2.2 on GA media (Moderate)	2021-08-10
oval:org.opensuse.security:def:63331	P	grub2-x86_64-xen-2.04-20.4 on GA media (Moderate)	2021-08-10
oval:org.opensuse.security:def:63038	P	perl-doc-5.26.1-15.87 on GA media (Moderate)	2021-08-09
oval:org.opensuse.security:def:62750	P	gnome-autoar-devel-0.2.3-3.3.1 on GA media (Moderate)	2021-08-09
oval:org.opensuse.security:def:62835	P	vorbis-tools-1.4.0-1.53 on GA media (Moderate)	2021-08-09
oval:org.opensuse.security:def:62747	P	gd-2.2.5-9.1 on GA media (Moderate)	2021-08-09
oval:org.opensuse.security:def:62743	P	fontforge-20200314-3.3.1 on GA media (Moderate)	2021-08-09
oval:org.opensuse.security:def:62832	P	texlive-collection-basic-2017.135.svn41616-9.12.1 on GA media (Moderate)	2021-08-09
oval:org.opensuse.security:def:62775	P	libass-devel-0.14.0-3.3.1 on GA media (Moderate)	2021-08-09
oval:org.opensuse.security:def:62828	P	rtkit-0.11+git.20130926-1.34 on GA media (Moderate)	2021-08-09
oval:org.opensuse.security:def:100311	P	(Moderate)	2021-07-20
oval:org.opensuse.security:def:62860	P	libtidy-devel-5.4.0-1.34 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:63534	P	freerdp-2.0.0~rc2-1.8 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:100287	P	(Important)	2021-06-02
oval:org.opensuse.security:def:64500	P	Recommended update for grub2 (Moderate)	2021-05-19
oval:org.opensuse.security:def:64483	P	Security update for webkit2gtk3 (Important)	2021-04-29
oval:org.opensuse.security:def:93598	P	(Important)	2021-03-24
oval:org.opensuse.security:def:64670	P	Security update for nghttp2 (Important)	2021-03-24
oval:org.opensuse.security:def:74697	P	Security update for git (Important)	2021-03-09
oval:org.opensuse.security:def:63596	P	libwmf-0_2-7-0.2.8.4-2.30 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:62953	P	gradle-4.4.1-1.87 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:25834	P	Security update for the Linux Kernel (Important)	2020-12-01
oval:org.opensuse.security:def:64375	P	libpython2_7-1_0 on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:63825	P	Security update for ucode-intel (Important)	2020-12-01
oval:org.opensuse.security:def:25262	P	Security update for spamassassin (Important)	2020-12-01
oval:org.opensuse.security:def:25790	P	Security update for flash-player (Important)	2020-12-01
oval:org.opensuse.security:def:25058	P	Security update for gdb (Moderate)	2020-12-01
oval:org.opensuse.security:def:64398	P	libvirt-libs on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:64239	P	dhcp on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:25134	P	Security update for apache2 (Important)	2020-12-01
oval:org.opensuse.security:def:74612	P	Security update for dpdk (Critical)	2020-12-01
oval:org.opensuse.security:def:25776	P	Security update for flash-player (Critical)	2020-12-01
oval:org.opensuse.security:def:25688	P	Security update for systemd (Important)	2020-12-01
oval:org.opensuse.security:def:63910	P	Security update for ovmf (Moderate)	2020-12-01
oval:org.opensuse.security:def:74830	P	Security update for cacti, cacti-spine (Important)	2020-12-01
oval:org.opensuse.security:def:25070	P	Security update for xen (Important)	2020-12-01
oval:org.opensuse.security:def:25635	P	Security update for tigervnc (Critical)	2020-12-01
oval:org.opensuse.security:def:63681	P	Security update for qemu (Important)	2020-12-01
oval:org.opensuse.security:def:25059	P	Security update for apache2-mod_auth_openidc (Important)	2020-12-01
oval:org.opensuse.security:def:64291	P	lftp on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:25484	P	Security update for libqt4 (Moderate)	2020-12-01
oval:org.opensuse.security:def:26507	P	Security update for cacti, cacti-spine (Important)	2020-12-01
oval:org.opensuse.security:def:64290	P	less on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:25400	P	Security update for bcm43xx-firmware (Moderate)	2020-12-01
oval:org.opensuse.security:def:26472	P	Security update for Chromium (Important)	2020-12-01
oval:org.opensuse.security:def:64376	P	libpython3_6m1_0 on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:64154	P	Security update for MozillaFirefox (Important)	2020-12-01
oval:org.opensuse.security:def:25343	P	Security update for kernel-firmware (Important)	2020-12-01
oval:org.opensuse.security:def:110492	P	Security update for cacti, cacti-spine (Important)	2020-04-27
oval:org.opensuse.security:def:110407	P	Security update for cacti, cacti-spine (Important)	2020-03-01
oval:com.ubuntu.disco:def:2018207260000000	V	CVE-2018-20726 on Ubuntu 19.04 (disco) - medium.	2019-01-16
oval:com.ubuntu.bionic:def:201820726000	V	CVE-2018-20726 on Ubuntu 18.04 LTS (bionic) - medium.	2019-01-16
oval:com.ubuntu.cosmic:def:2018207260000000	V	CVE-2018-20726 on Ubuntu 18.10 (cosmic) - medium.	2019-01-16
oval:com.ubuntu.cosmic:def:201820726000	V	CVE-2018-20726 on Ubuntu 18.10 (cosmic) - medium.	2019-01-16
oval:com.ubuntu.bionic:def:2018207260000000	V	CVE-2018-20726 on Ubuntu 18.04 LTS (bionic) - medium.	2019-01-16
oval:com.ubuntu.trusty:def:201820726000	V	CVE-2018-20726 on Ubuntu 14.04 LTS (trusty) - medium.	2019-01-16
oval:com.ubuntu.xenial:def:2018207260000000	V	CVE-2018-20726 on Ubuntu 16.04 LTS (xenial) - medium.	2019-01-16
oval:com.ubuntu.xenial:def:201820726000	V	CVE-2018-20726 on Ubuntu 16.04 LTS (xenial) - medium.	2019-01-16

BACK