CVE-2018-10060
MEDIUMCacti < 1.1.37 - Cross-Site Scripting via sanitize_uri Function
Title source: llmDescription
Cacti before 1.1.37 has XSS because it does not properly reject unintended characters, related to use of the sanitize_uri function in lib/functions.php.
References (4)
Core 4
Core References
Exploit, Patch, Third Party Advisory x_refsource_misc
https://github.com/Cacti/cacti/issues/1457
Release Notes x_refsource_misc
https://www.cacti.net/changelog.php
Third Party Advisory, VDB Entry vdb-entry
x_refsource_sectrack
http://www.securitytracker.com/id/1040620
Mailing List, Third Party Advisory mailing-list
x_refsource_mlist
https://lists.debian.org/debian-lts-announce/2022/03/msg00038.html
Scores
CVSS v3
5.4
EPSS
0.0101
EPSS Percentile
59.8%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Details
CWE
CWE-79
Status
published
Products (2)
cacti/cacti
< 1.1.36
debian/debian_linux
9.0
Published
Apr 12, 2018
Tracked Since
Feb 18, 2026