Bug 1896695 (CVE-2020-25706)

Summary:	CVE-2020-25706 cacti: Improper escaping of error message leads to XSS during template import preview
Product:	[Other] Security Response	Reporter:	Michael Kaplan <mkaplan>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	imlinux+fedora, marc.w.hagen, ms
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	cacti 1.2.14	Doc Type:	---
Doc Text:	A Cross-site scripting (XSS) flaw was found in Cacti in the templates_import.php, caused by an improper escaping of error message during the template import preview in the xml_path field. The highest threat from this vulnerability is to confidentiality and integrity.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-10-28 05:27:39 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Michael Kaplan 2020-11-11 10:06:19 UTC

A cross-site scripting (XSS) vulnerability exists in templates_import.php (Cacti
1.2.13) due to Improper escaping of error message during template
import preview in the xml_path field

Comment 1 Michael Kaplan 2020-11-11 10:06:25 UTC

Acknowledgments:

Name: listerjoe

Comment 3 Michael Kaplan 2020-11-11 10:06:52 UTC

External References:

https://github.com/Cacti/cacti/issues/3723
https://github.com/Cacti/cacti/commit/39458efcd5286d50e6b7f905fedcdc1059354e6e