NOTE: This is an example draft advisory and should not be published, please comment on whether you think we should include anything else with the advisory's on future disclosures

Impact

Multiple XSS issues existed within Cacti 1.2.x versions prior to 1.2.13.

Patches

This has now been patch with the release of 1.2.13

Workarounds

No end user workarounds are advised about from upgrading at this time.

References

See the following issue trackers:

• Lack of escaping on some pages can lead to XSS exposure
• SQL Injection vulnerability due to input validation failure when editing colors
• Lack of escaping on template import can lead to XSS exposure

For more information

If you have any questions or comments about this advisory:

• Comment on the existing issue tracker
• Email us at developers@cacti.net