Catalogo CVE

CVE-2019-11025

cacti: CVE-2019-11025

[Catalogo CVE]

Gravità
Medium
Published
Source
[NVD] · [CVE record]
EPSS
1.32% · Oct 22, 2026

In clearFilter() in utilities.php in Cacti before 1.2.3, no escaping occurs before printing out the value of the SNMP community string (SNMP Options) in the View poller cache, leading to XSS.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiancactisid1.2.31+ds1-4fixed
Debiancactiforky1.2.31+ds1-4fixed
Debiancactitrixie1.2.30+ds1-1fixed
Debiancactibookworm1.2.24+ds1-1+deb12u5fixed
Debiancactibookworm-security1.2.24+ds1-1+deb12u5fixed
Ubuntucactipro1.1.18+ds1-1vulnerable
Ubuntucactipro1.1.27+ds1-2vulnerable
Ubuntucactipro1.1.27+ds1-3vulnerable
Ubuntucactipro1.1.28+ds1-2vulnerable
Ubuntucactipro1.1.35+ds1-1vulnerable
Ubuntucactipro1.1.36+ds1-1vulnerable
Ubuntucactipro1.1.38+ds1-1vulnerable
Ubuntucactipro1.1.38+ds1-1ubuntu0.1~esm1vulnerable
Ubuntucactipro1.1.38+ds1-1ubuntu0.1~esm3vulnerable
Ubuntucactipro1.1.38+ds1-1ubuntu0.1~esm4vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiancactisourcesid1.2.2+ds1-2lowNot reported[926700]
Debiancactisourceforky1.2.2+ds1-2lowNot reported[926700]
Debiancactisourcetrixie1.2.2+ds1-2lowNot reported[926700]
Debiancactisourcebookworm1.2.2+ds1-2lowNot reported[926700]

[Debian bug #926700]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [cacti]Corretta
    Dettagli (4)

    • 1.2.24+ds1-1+deb12u5 · all · bookworm

      Corretta · Corretta: 1.2.2+ds1-2

      dsa · cacti · debian · bookworm; dsa · cacti · debian · 12

    • 1.2.24+ds1-1+deb12u5 · all · bookworm

      Corretta · Corretta: 1.2.2+ds1-2

      dsa · cacti · debian · bookworm; dsa · cacti · debian · 12

    • 1.2.24+ds1-1+deb12u5 · all · bookworm-security

      Corretta · Corretta: 1.2.2+ds1-2

      dsa · cacti · debian · bookworm; dsa · cacti · debian · 12

    • 1.2.24+ds1-1+deb12u5 · all · bookworm-security

      Corretta · Corretta: 1.2.2+ds1-2

      dsa · cacti · debian · bookworm; dsa · cacti · debian · 12

[Debian 13 (Trixie)]

  • [cacti]Corretta
    Dettagli (2)

    • 1.2.30+ds1-1 · all · trixie

      Corretta · Corretta: 1.2.2+ds1-2

      dsa · cacti · debian · 13

    • 1.2.30+ds1-1 · all · trixie

      Corretta · Corretta: 1.2.2+ds1-2

      dsa · cacti · debian · 13

Osservato:

Riferimenti

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]