Cross-site scripting (XSS) vulnerability in auth_profile.php in Cacti 1.1.13
kimiizhang opened this issue · comments
ziqiang.wang@dbappsecurity.com.cn
From this issue : #847 , the Cacti vendor has published the latest 1.1.13 to fix two XSS vuls.
But I just found a new xss vul in 1.1.13, plz donnt say its the same issue or ask why is there a new CVE number? Because it's a real vul in the latest 1.1.13.
Cross-site scripting (XSS) vulnerability in auth_profile.php in Cacti 1.1.13 allows remote authenticated users to inject arbitrary web script or HTML via specially crafted HTTP Referer headers.
Resolve. Thanks for your efforts in making Cacti a better tool. Keep up the good work!
This issue has been assigned CVE-2017-11691