CVE-2017-10970
Advisory lineage Upstream: 0 Downstream: 3
Modified
Published: 06 Jul 2017, 11:00
Last modified:05 Aug 2024, 17:57
Vulnerability Summary
Overall Risk (default)
low
22/100 CVSS Score
5.4 MEDIUM
v3.0 (nvd)
EPSS Score
0.19% LOW
0% probability -0.03%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected
Timeline
06 Jul 2017, 11:00
Published
Vulnerability first disclosed
05 Aug 2024, 17:57
Last Modified
Vulnerability information updated
Description
Cross-site scripting (XSS) vulnerability in link.php in Cacti 1.1.12 allows remote anonymous users to inject arbitrary web script or HTML via the id parameter, related to the die_html_input_error function in lib/html_validate.php.
CVSS Metrics
- v3.0•MEDIUM•Score: 5.4CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
- v2.0•MEDIUM•Score: 4.3AV:N/AC:M/Au:N/C:N/I:P/A:N
EPSS Trends
Current EPSS score: 0.19%• Percentile: 41%
Techniques & Countermeasures
- CWE-79•Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Affected Systems
- Unknown•Cacti
1.1.12