Subject: [ASA-201707-30] cacti: cross-site scripting

Arch Linux Security Advisory ASA-201707-30
==========================================

Severity: Medium
Date    : 2017-07-27
CVE-ID  : CVE-2017-11691
Package : cacti
Type    : cross-site scripting
Remote  : Yes
Link    : https://security.archlinux.org/AVG-365

Summary
=======

The package cacti before version 1.1.14-1 is vulnerable to cross-site
scripting.

Resolution
==========

Upgrade to 1.1.14-1.

# pacman -Syu "cacti>=1.1.14-1"

The problem has been fixed upstream in version 1.1.14.

Workaround
==========

None.

Description
===========

A cross-site scripting vulnerability has been found in Cacti <= 1.1.13,
in the user profile management page (auth_profile.php), allowing inject
arbitrary web script or HTML via specially crafted HTTP Referer
headers.

Impact
======

A remote authenticated attacker might be able to inject arbitrary web
script or HTML via crafted Referer headers.

References
==========

http://seclists.org/oss-sec/2017/q3/217
https://github.com/Cacti/cacti/issues/867
https://github.com/Cacti/cacti/commit/104090aeead4aa433bf1f18cd6d52dcfeb71236c
https://security.archlinux.org/CVE-2017-11691