Cacti up to 1.1.36 lib/functions.php sanitize_uri cross site scripting

Summaryinfo

A vulnerability, which was classified as problematic, has been found in Cacti up to 1.1.36. This affects the function sanitize_uri in the library lib/functions.php. This manipulation causes cross site scripting. This vulnerability appears as CVE-2018-10060. The attack may be initiated remotely. There is no available exploit. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic was found in Cacti up to 1.1.36 (Log Management Software). Affected by this vulnerability is the function sanitize_uri in the library lib/functions.php. The manipulation with an unknown input leads to a cross site scripting vulnerability. The CWE definition for the vulnerability is CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. As an impact it is known to affect integrity. The summary by CVE is:

Cacti before 1.1.37 has XSS because it does not properly reject unintended characters, related to use of the sanitize_uri function in lib/functions.php.

The bug was discovered 03/08/2018. The weakness was presented 04/12/2018 (Website). The advisory is shared at securitytracker.com. This vulnerability is known as CVE-2018-10060 since 04/12/2018. The attack can be launched remotely. The successful exploitation needs a single authentication. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1059.007 for this issue.

The vulnerability was handled as a non-public zero-day exploit for at least 35 days. During that time the estimated underground price was around $0-$5k. By approaching the search of inurl:lib/functions.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 1.1.37 eliminates this vulnerability.

See VDB-116172 and VDB-116174 for similar entries. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Log Management Software

Name

• Cacti

Version

• 1.1.0
• 1.1.1
• 1.1.2
• 1.1.3
• 1.1.4
• 1.1.5
• 1.1.6
• 1.1.7
• 1.1.8
• 1.1.9
• 1.1.10
• 1.1.11
• 1.1.12
• 1.1.13
• 1.1.14
• 1.1.15
• 1.1.16
• 1.1.17
• 1.1.18
• 1.1.19
• 1.1.20
• 1.1.21
• 1.1.22
• 1.1.23
• 1.1.24
• 1.1.25
• 1.1.26
• 1.1.27
• 1.1.28
• 1.1.29
• 1.1.30
• 1.1.31
• 1.1.32
• 1.1.33
• 1.1.34
• 1.1.35
• 1.1.36

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion