CVE-2020-7106

2020-01-1604:15:11

Google

osv.dev

5.9 Medium

AI Score

Confidence

High

0.018 Low

EPSS

Percentile

88.1%

JSON

Cacti 1.2.8 has stored XSS in data_sources.php, color_templates_item.php, graphs.php, graph_items.php, lib/api_automation.php, user_admin.php, and user_group_admin.php, as demonstrated by the description parameter in data_sources.php (a raw string from the database that is displayed by $header to trigger the XSS).

CPENameOperatorVersion
cactieqrelease/1.1.20
cactieqrelease/1.1.7
cactieqrelease/1.1.27
cactieqrelease/1.1.38
cactieqrelease/1.1.22
cactieqrelease/1.1.5
cactieqrelease/1.0.3
cactieqrelease/1.1.21
cactieqrelease/1.1.6
cactieqrelease/1.2.0

Name	Operator	Version
cacti	eq	release/1.1.20
cacti	eq	release/1.1.7
cacti	eq	release/1.1.27
cacti	eq	release/1.1.38
cacti	eq	release/1.1.22
cacti	eq	release/1.1.5
cacti	eq	release/1.0.3
cacti	eq	release/1.1.21
cacti	eq	release/1.1.6
cacti	eq	release/1.2.0