Bug 626326 (CVE-2017-11691)

Summary:	<net-analyzer/cacti-1.1.20: Cross-site scripting vulnerability in auth_profile.php (CVE-2017-11691)
Product:	Gentoo Security	Reporter:	Aleksandr Wagner (Kivak) <alwag>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	normal	CC:	netmon
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
Whiteboard:	C4 [noglsa cve]
Package list:		Runtime testing required:	---
Bug Depends on:	626992
Bug Blocks:

Description Aleksandr Wagner (Kivak) 2017-07-27 08:16:54 UTC

CVE-2017-11691 (http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11691):

Cross-site scripting (XSS) vulnerability in auth_profile.php in Cacti 1.1.13 allows remote attackers to inject arbitrary web script or HTML via specially crafted HTTP Referer headers. 

References:

https://github.com/Cacti/cacti/issues/867
https://github.com/Cacti/cacti/commit/104090aeead4aa433bf1f18cd6d52dcfeb71236c

Comment 1 Thomas Deutschmann (RETIRED) gentoo-dev

2017-08-21 13:44:51 UTC

Stabilization will happen in bug 626992.