[arch-security] [ASA-201707-30] cacti: cross-site scripting
rgacogne at archlinux.org
Fri Jul 28 08:58:02 UTC 2017
Arch Linux Security Advisory ASA-201707-30
Date : 2017-07-27
CVE-ID : CVE-2017-11691
Package : cacti
Type : cross-site scripting
Remote : Yes
Link : https://security.archlinux.org/AVG-365
The package cacti before version 1.1.14-1 is vulnerable to cross-site
Upgrade to 1.1.14-1.
# pacman -Syu "cacti>=1.1.14-1"
The problem has been fixed upstream in version 1.1.14.
A cross-site scripting vulnerability has been found in Cacti <= 1.1.13,
in the user profile management page (auth_profile.php), allowing inject
arbitrary web script or HTML via specially crafted HTTP Referer
A remote authenticated attacker might be able to inject arbitrary web
script or HTML via crafted Referer headers.
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 833 bytes
Desc: OpenPGP digital signature
More information about the arch-security