CVE catalog

CVE-2019-11025

cacti: CVE-2019-11025

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
1.32% · Oct 22, 2026

In clearFilter() in utilities.php in Cacti before 1.2.3, no escaping occurs before printing out the value of the SNMP community string (SNMP Options) in the View poller cache, leading to XSS.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiancactisid1.2.31+ds1-4fixed
Debiancactiforky1.2.31+ds1-4fixed
Debiancactitrixie1.2.30+ds1-1fixed
Debiancactibookworm1.2.24+ds1-1+deb12u5fixed
Debiancactibookworm-security1.2.24+ds1-1+deb12u5fixed
Ubuntucactipro1.1.18+ds1-1vulnerable
Ubuntucactipro1.1.27+ds1-2vulnerable
Ubuntucactipro1.1.27+ds1-3vulnerable
Ubuntucactipro1.1.28+ds1-2vulnerable
Ubuntucactipro1.1.35+ds1-1vulnerable
Ubuntucactipro1.1.36+ds1-1vulnerable
Ubuntucactipro1.1.38+ds1-1vulnerable
Ubuntucactipro1.1.38+ds1-1ubuntu0.1~esm1vulnerable
Ubuntucactipro1.1.38+ds1-1ubuntu0.1~esm3vulnerable
Ubuntucactipro1.1.38+ds1-1ubuntu0.1~esm4vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiancactisourcesid1.2.2+ds1-2lowNot reported[926700]
Debiancactisourceforky1.2.2+ds1-2lowNot reported[926700]
Debiancactisourcetrixie1.2.2+ds1-2lowNot reported[926700]
Debiancactisourcebookworm1.2.2+ds1-2lowNot reported[926700]

[Debian bug #926700]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [cacti]Fixed
    Details (4)

    • 1.2.24+ds1-1+deb12u5 · all · bookworm

      Fixed · Fixed: 1.2.2+ds1-2

      dsa · cacti · debian · bookworm; dsa · cacti · debian · 12

    • 1.2.24+ds1-1+deb12u5 · all · bookworm

      Fixed · Fixed: 1.2.2+ds1-2

      dsa · cacti · debian · bookworm; dsa · cacti · debian · 12

    • 1.2.24+ds1-1+deb12u5 · all · bookworm-security

      Fixed · Fixed: 1.2.2+ds1-2

      dsa · cacti · debian · bookworm; dsa · cacti · debian · 12

    • 1.2.24+ds1-1+deb12u5 · all · bookworm-security

      Fixed · Fixed: 1.2.2+ds1-2

      dsa · cacti · debian · bookworm; dsa · cacti · debian · 12

[Debian 13 (Trixie)]

  • [cacti]Fixed
    Details (2)

    • 1.2.30+ds1-1 · all · trixie

      Fixed · Fixed: 1.2.2+ds1-2

      dsa · cacti · debian · 13

    • 1.2.30+ds1-1 · all · trixie

      Fixed · Fixed: 1.2.2+ds1-2

      dsa · cacti · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]