Vulnerability CVE-2020-14424: Information

Description

Cacti before 1.2.18 allows remote attackers to trigger XSS via template import for the midwinter theme.

Severity: MEDIUM (6.1) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

URL: https://nvd.nist.gov/vuln/detail/CVE-2020-14424

Published: Nov. 14, 2021

Modified: Nov. 16, 2021

Error type identifier: CWE-79

Fixed packages

Package name	Branch	Fixed in version	Version from repository	Errata ID	Task #	State
cacti	sisyphus	1.2.18-alt1	1.2.26-alt1	ALT-PU-2021-2264-1	279428	Fixed
cacti	p10	1.2.18-alt1	1.2.26-alt1	ALT-PU-2021-2264-1	279428	Fixed
cacti	c10f1	1.2.18-alt1	1.2.26-alt1	ALT-PU-2021-2264-1	279428	Fixed

Hyperlink	Resource
https://bugzilla.redhat.com/show_bug.cgi?id=2001016	Issue Tracking Third Party Advisory
https://github.com/Cacti/cacti/pull/4261	Patch Third Party Advisory

Affected configurations:
1. Configuration 1
  cpe:2.3:a:cacti:cacti:*:*:*:*:*:*:*:*
  End excliding
  1.2.18

Version: v24.5.0