Vulnerability-Lookup

CVE-2018-20726 (GCVE-0-2018-20726)

Vulnerability from cvelistv5 – Published: 2019-01-16 16:00 – Updated: 2024-08-05 12:12

Summary

A cross-site scripting (XSS) vulnerability exists in host.php (via tree.php) in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Website Hostname field for Devices.

Severity

5.4 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CWE

Assigner

mitre mitre root

References

7 references

URL	Tags
https://github.com/Cacti/cacti/commit/80c2a88fb2a…	x_refsource_MISC
https://github.com/Cacti/cacti/blob/develop/CHANGELOG	x_refsource_MISC
https://github.com/Cacti/cacti/issues/2213	x_refsource_MISC
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE

Date Public

2019-01-16 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T12:12:28.314Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/Cacti/cacti/commit/80c2a88fb2afb93f87703ba4641f9970478c102d"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/Cacti/cacti/blob/develop/CHANGELOG"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/Cacti/cacti/issues/2213"
          },
          {
            "name": "openSUSE-SU-2020:0272",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00001.html"
          },
          {
            "name": "openSUSE-SU-2020:0284",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00005.html"
          },
          {
            "name": "openSUSE-SU-2020:0558",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00042.html"
          },
          {
            "name": "openSUSE-SU-2020:0565",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00048.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2019-01-16T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A cross-site scripting (XSS) vulnerability exists in host.php (via tree.php) in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Website Hostname field for Devices."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-04-30T20:06:07.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Cacti/cacti/commit/80c2a88fb2afb93f87703ba4641f9970478c102d"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Cacti/cacti/blob/develop/CHANGELOG"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Cacti/cacti/issues/2213"
        },
        {
          "name": "openSUSE-SU-2020:0272",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00001.html"
        },
        {
          "name": "openSUSE-SU-2020:0284",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00005.html"
        },
        {
          "name": "openSUSE-SU-2020:0558",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00042.html"
        },
        {
          "name": "openSUSE-SU-2020:0565",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00048.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2018-20726",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A cross-site scripting (XSS) vulnerability exists in host.php (via tree.php) in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Website Hostname field for Devices."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/Cacti/cacti/commit/80c2a88fb2afb93f87703ba4641f9970478c102d",
              "refsource": "MISC",
              "url": "https://github.com/Cacti/cacti/commit/80c2a88fb2afb93f87703ba4641f9970478c102d"
            },
            {
              "name": "https://github.com/Cacti/cacti/blob/develop/CHANGELOG",
              "refsource": "MISC",
              "url": "https://github.com/Cacti/cacti/blob/develop/CHANGELOG"
            },
            {
              "name": "https://github.com/Cacti/cacti/issues/2213",
              "refsource": "MISC",
              "url": "https://github.com/Cacti/cacti/issues/2213"
            },
            {
              "name": "openSUSE-SU-2020:0272",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00001.html"
            },
            {
              "name": "openSUSE-SU-2020:0284",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00005.html"
            },
            {
              "name": "openSUSE-SU-2020:0558",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00042.html"
            },
            {
              "name": "openSUSE-SU-2020:0565",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00048.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2018-20726",
    "datePublished": "2019-01-16T16:00:00.000Z",
    "dateReserved": "2019-01-16T00:00:00.000Z",
    "dateUpdated": "2024-08-05T12:12:28.314Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2018-20726",
      "date": "2026-09-14",
      "epss": "0.01046",
      "percentile": "0.62262"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cacti:cacti:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"1.2.0\", \"matchCriteriaId\": \"1C7FEEA7-B141-4E6E-8B73-4DFF4844A341\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"A cross-site scripting (XSS) vulnerability exists in host.php (via tree.php) in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Website Hostname field for Devices.\"}, {\"lang\": \"es\", \"value\": \"Existe una vulnerabilidad Cross-Site Scripting (XSS) en host.php (mediante tree.php) en Cacti, en versiones anteriores a la 1.2.0, debido a la falta de escapado de caracteres no planeados en el campo Website Hostname de Devices.\"}]",
      "id": "CVE-2018-20726",
      "lastModified": "2024-11-21T04:02:02.620",
      "metrics": "{\"cvssMetricV30\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.0\", \"vectorString\": \"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N\", \"baseScore\": 5.4, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"REQUIRED\", \"scope\": \"CHANGED\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"LOW\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 2.3, \"impactScore\": 2.7}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:M/Au:S/C:N/I:P/A:N\", \"baseScore\": 3.5, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"MEDIUM\", \"authentication\": \"SINGLE\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"PARTIAL\", \"availabilityImpact\": \"NONE\"}, \"baseSeverity\": \"LOW\", \"exploitabilityScore\": 6.8, \"impactScore\": 2.9, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": true}]}",
      "published": "2019-01-16T16:29:00.697",
      "references": "[{\"url\": \"http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00001.html\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00005.html\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00042.html\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00048.html\", \"source\": \"cve@mitre.org\"}, {\"url\": \"https://github.com/Cacti/cacti/blob/develop/CHANGELOG\", \"source\": \"cve@mitre.org\", \"tags\": [\"Release Notes\", \"Third Party Advisory\"]}, {\"url\": \"https://github.com/Cacti/cacti/commit/80c2a88fb2afb93f87703ba4641f9970478c102d\", \"source\": \"cve@mitre.org\", \"tags\": [\"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://github.com/Cacti/cacti/issues/2213\", \"source\": \"cve@mitre.org\", \"tags\": [\"Exploit\", \"Issue Tracking\", \"Third Party Advisory\"]}, {\"url\": \"http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00001.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00005.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00042.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00048.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://github.com/Cacti/cacti/blob/develop/CHANGELOG\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Release Notes\", \"Third Party Advisory\"]}, {\"url\": \"https://github.com/Cacti/cacti/commit/80c2a88fb2afb93f87703ba4641f9970478c102d\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://github.com/Cacti/cacti/issues/2213\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Exploit\", \"Issue Tracking\", \"Third Party Advisory\"]}]",
      "sourceIdentifier": "cve@mitre.org",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-79\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2018-20726\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2019-01-16T16:29:00.697\",\"lastModified\":\"2024-11-21T04:02:02.620\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A cross-site scripting (XSS) vulnerability exists in host.php (via tree.php) in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Website Hostname field for Devices.\"},{\"lang\":\"es\",\"value\":\"Existe una vulnerabilidad Cross-Site Scripting (XSS) en host.php (mediante tree.php) en Cacti, en versiones anteriores a la 1.2.0, debido a la falta de escapado de caracteres no planeados en el campo Website Hostname de Devices.\"}],\"metrics\":{\"cvssMetricV30\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N\",\"baseScore\":5.4,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.3,\"impactScore\":2.7}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:S/C:N/I:P/A:N\",\"baseScore\":3.5,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"SINGLE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"LOW\",\"exploitabilityScore\":6.8,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":true}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cacti:cacti:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"1.2.0\",\"matchCriteriaId\":\"1C7FEEA7-B141-4E6E-8B73-4DFF4844A341\"}]}]}],\"references\":[{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00001.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00005.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00042.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00048.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://github.com/Cacti/cacti/blob/develop/CHANGELOG\",\"source\":\"cve@mitre.org\",\"tags\":[\"Release Notes\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/Cacti/cacti/commit/80c2a88fb2afb93f87703ba4641f9970478c102d\",\"source\":\"cve@mitre.org\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/Cacti/cacti/issues/2213\",\"source\":\"cve@mitre.org\",\"tags\":[\"Exploit\",\"Issue Tracking\",\"Third Party Advisory\"]},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00001.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00005.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00042.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00048.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://github.com/Cacti/cacti/blob/develop/CHANGELOG\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Release Notes\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/Cacti/cacti/commit/80c2a88fb2afb93f87703ba4641f9970478c102d\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/Cacti/cacti/issues/2213\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Issue Tracking\",\"Third Party Advisory\"]}]}}",
    "redhat_vex": {
      "current_release_date": "2025-11-21T16:08:10+00:00",
      "cve": "CVE-2018-20726",
      "id": "CVE-2018-20726",
      "initial_release_date": "2018-12-16T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "cacti: Multiple cross-site scripting vulnerabilities fixed in 1.2.0 version",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2018/cve-2018-20726.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "low",
      "current_release_date": "2026-06-07T05:38:04Z",
      "cve": "CVE-2018-20726",
      "id": "CVE-2018-20726",
      "initial_release_date": "2023-02-15T04:20:54Z",
      "product_status:recommended": "7",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2018-20726",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2018-20726.json",
      "version": "8"
    }
  }
}

CNVD-2019-14553

Vulnerability from cnvd - Published: 2019-05-16

Title

Cacti跨站脚本漏洞（CNVD-2019-14553）

Description

Cacti是一款开源、基于web的网络监控和绘图工具，是为数据记录工具RRDtool设计的前端应用程序。 Cacti 1.2.0之前版本中的host.php文件的‘Website Hostname’参数存在跨站脚本漏洞，该漏洞源于程序未能转义非法字符，远程攻击者可利用该漏洞注入任意的Web脚本或HTML。

Severity

低

Patch Name

Cacti跨站脚本漏洞（CNVD-2019-14553）的补丁

Patch Description

Formal description

厂商已发布了漏洞修复程序，请及时关注更新： https://github.com/Cacti/cacti/commit/80c2a88fb2afb93f87703ba4641f9970478c102d

Reference

https://nvd.nist.gov/vuln/detail/CVE-2018-20726

Impacted products

Name
Cacti Cacti <1.2.0

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2018-20726"
    }
  },
  "description": "Cacti\u662f\u4e00\u6b3e\u5f00\u6e90\u3001\u57fa\u4e8eweb\u7684\u7f51\u7edc\u76d1\u63a7\u548c\u7ed8\u56fe\u5de5\u5177\uff0c\u662f\u4e3a\u6570\u636e\u8bb0\u5f55\u5de5\u5177RRDtool\u8bbe\u8ba1\u7684\u524d\u7aef\u5e94\u7528\u7a0b\u5e8f\u3002\n\nCacti 1.2.0\u4e4b\u524d\u7248\u672c\u4e2d\u7684host.php\u6587\u4ef6\u7684\u2018Website Hostname\u2019\u53c2\u6570\u5b58\u5728\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7a0b\u5e8f\u672a\u80fd\u8f6c\u4e49\u975e\u6cd5\u5b57\u7b26\uff0c\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u6ce8\u5165\u4efb\u610f\u7684Web\u811a\u672c\u6216HTML\u3002",
  "discovererName": "SegfaultMasters",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://github.com/Cacti/cacti/commit/80c2a88fb2afb93f87703ba4641f9970478c102d",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2019-14553",
  "openTime": "2019-05-16",
  "patchDescription": "Cacti\u662f\u4e00\u6b3e\u5f00\u6e90\u3001\u57fa\u4e8eweb\u7684\u7f51\u7edc\u76d1\u63a7\u548c\u7ed8\u56fe\u5de5\u5177\uff0c\u662f\u4e3a\u6570\u636e\u8bb0\u5f55\u5de5\u5177RRDtool\u8bbe\u8ba1\u7684\u524d\u7aef\u5e94\u7528\u7a0b\u5e8f\u3002\r\n\r\nCacti 1.2.0\u4e4b\u524d\u7248\u672c\u4e2d\u7684host.php\u6587\u4ef6\u7684\u2018Website Hostname\u2019\u53c2\u6570\u5b58\u5728\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7a0b\u5e8f\u672a\u80fd\u8f6c\u4e49\u975e\u6cd5\u5b57\u7b26\uff0c\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u6ce8\u5165\u4efb\u610f\u7684Web\u811a\u672c\u6216HTML\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Cacti\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\uff08CNVD-2019-14553\uff09\u7684\u8865\u4e01",
  "products": {
    "product": "Cacti Cacti \u003c1.2.0"
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2018-20726",
  "serverity": "\u4f4e",
  "submitTime": "2019-01-17",
  "title": "Cacti\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\uff08CNVD-2019-14553\uff09"
}

FKIE_CVE-2018-20726

Vulnerability from fkie_nvd - Published: 2019-01-16 16:29 - Updated: 2026-06-17 01:53

Severity

5.4 (Medium) - CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Summary

A cross-site scripting (XSS) vulnerability exists in host.php (via tree.php) in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Website Hostname field for Devices.

References

URL	Tags
cve@mitre.org	http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00001.html
cve@mitre.org	http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00005.html
cve@mitre.org	http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00042.html
cve@mitre.org	http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00048.html
cve@mitre.org	https://github.com/Cacti/cacti/blob/develop/CHANGELOG	Release Notes, Third Party Advisory
cve@mitre.org	https://github.com/Cacti/cacti/commit/80c2a88fb2afb93f87703ba4641f9970478c102d	Patch, Third Party Advisory
cve@mitre.org	https://github.com/Cacti/cacti/issues/2213	Exploit, Issue Tracking, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00001.html
af854a3a-2127-422b-91ae-364da2661108	http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00005.html
af854a3a-2127-422b-91ae-364da2661108	http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00042.html
af854a3a-2127-422b-91ae-364da2661108	http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00048.html
af854a3a-2127-422b-91ae-364da2661108	https://github.com/Cacti/cacti/blob/develop/CHANGELOG	Release Notes, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/Cacti/cacti/commit/80c2a88fb2afb93f87703ba4641f9970478c102d	Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/Cacti/cacti/issues/2213	Exploit, Issue Tracking, Third Party Advisory

Impacted products

	Vendor	Product	Version
	cacti	cacti	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "cve@mitre.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:cacti:cacti:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "1C7FEEA7-B141-4E6E-8B73-4DFF4844A341",
              "versionEndExcluding": "1.2.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A cross-site scripting (XSS) vulnerability exists in host.php (via tree.php) in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Website Hostname field for Devices."
    },
    {
      "lang": "es",
      "value": "Existe una vulnerabilidad Cross-Site Scripting (XSS) en host.php (mediante tree.php) en Cacti, en versiones anteriores a la 1.2.0, debido a la falta de escapado de caracteres no planeados en el campo Website Hostname de Devices."
    }
  ],
  "id": "CVE-2018-20726",
  "lastModified": "2026-06-17T01:53:21.703",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "LOW",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "NONE",
          "baseScore": 3.5,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 6.8,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.4,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.0"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 2.7,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2019-01-16T16:29:00.697",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00001.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00005.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00042.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00048.html"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Release Notes",
        "Third Party Advisory"
      ],
      "url": "https://github.com/Cacti/cacti/blob/develop/CHANGELOG"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/Cacti/cacti/commit/80c2a88fb2afb93f87703ba4641f9970478c102d"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit",
        "Issue Tracking",
        "Third Party Advisory"
      ],
      "url": "https://github.com/Cacti/cacti/issues/2213"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00001.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00005.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00042.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00048.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Release Notes",
        "Third Party Advisory"
      ],
      "url": "https://github.com/Cacti/cacti/blob/develop/CHANGELOG"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/Cacti/cacti/commit/80c2a88fb2afb93f87703ba4641f9970478c102d"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Issue Tracking",
        "Third Party Advisory"
      ],
      "url": "https://github.com/Cacti/cacti/issues/2213"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-39RW-HW3X-2QP8

Vulnerability from github – Published: 2022-05-13 01:28 – Updated: 2022-05-13 01:28

Details

A cross-site scripting (XSS) vulnerability exists in host.php (via tree.php) in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Website Hostname field for Devices.

Severity

5.4 (Medium)


                  
                    CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2018-20726"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-01-16T16:29:00Z",
    "severity": "MODERATE"
  },
  "details": "A cross-site scripting (XSS) vulnerability exists in host.php (via tree.php) in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Website Hostname field for Devices.",
  "id": "GHSA-39rw-hw3x-2qp8",
  "modified": "2022-05-13T01:28:02Z",
  "published": "2022-05-13T01:28:02Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-20726"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Cacti/cacti/issues/2213"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Cacti/cacti/commit/80c2a88fb2afb93f87703ba4641f9970478c102d"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Cacti/cacti/blob/develop/CHANGELOG"
    },
    {
      "type": "WEB",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00001.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00005.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00042.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00048.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GSD-2018-20726

Vulnerability from gsd - Updated: 2023-12-13 01:22

Details

A cross-site scripting (XSS) vulnerability exists in host.php (via tree.php) in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Website Hostname field for Devices.

Aliases

CVE-2018-20726

Aliases

CVE-2018-20726

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2018-20726",
    "description": "A cross-site scripting (XSS) vulnerability exists in host.php (via tree.php) in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Website Hostname field for Devices.",
    "id": "GSD-2018-20726",
    "references": [
      "https://www.suse.com/security/cve/CVE-2018-20726.html"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2018-20726"
      ],
      "details": "A cross-site scripting (XSS) vulnerability exists in host.php (via tree.php) in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Website Hostname field for Devices.",
      "id": "GSD-2018-20726",
      "modified": "2023-12-13T01:22:29.278272Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cve@mitre.org",
        "ID": "CVE-2018-20726",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "n/a",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "n/a"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "A cross-site scripting (XSS) vulnerability exists in host.php (via tree.php) in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Website Hostname field for Devices."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "n/a"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://github.com/Cacti/cacti/commit/80c2a88fb2afb93f87703ba4641f9970478c102d",
            "refsource": "MISC",
            "url": "https://github.com/Cacti/cacti/commit/80c2a88fb2afb93f87703ba4641f9970478c102d"
          },
          {
            "name": "https://github.com/Cacti/cacti/blob/develop/CHANGELOG",
            "refsource": "MISC",
            "url": "https://github.com/Cacti/cacti/blob/develop/CHANGELOG"
          },
          {
            "name": "https://github.com/Cacti/cacti/issues/2213",
            "refsource": "MISC",
            "url": "https://github.com/Cacti/cacti/issues/2213"
          },
          {
            "name": "openSUSE-SU-2020:0272",
            "refsource": "SUSE",
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00001.html"
          },
          {
            "name": "openSUSE-SU-2020:0284",
            "refsource": "SUSE",
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00005.html"
          },
          {
            "name": "openSUSE-SU-2020:0558",
            "refsource": "SUSE",
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00042.html"
          },
          {
            "name": "openSUSE-SU-2020:0565",
            "refsource": "SUSE",
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00048.html"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:cacti:cacti:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "1.2.0",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2018-20726"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "A cross-site scripting (XSS) vulnerability exists in host.php (via tree.php) in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Website Hostname field for Devices."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-79"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/Cacti/cacti/issues/2213",
              "refsource": "MISC",
              "tags": [
                "Issue Tracking",
                "Exploit",
                "Third Party Advisory"
              ],
              "url": "https://github.com/Cacti/cacti/issues/2213"
            },
            {
              "name": "https://github.com/Cacti/cacti/commit/80c2a88fb2afb93f87703ba4641f9970478c102d",
              "refsource": "MISC",
              "tags": [
                "Patch",
                "Third Party Advisory"
              ],
              "url": "https://github.com/Cacti/cacti/commit/80c2a88fb2afb93f87703ba4641f9970478c102d"
            },
            {
              "name": "https://github.com/Cacti/cacti/blob/develop/CHANGELOG",
              "refsource": "MISC",
              "tags": [
                "Release Notes",
                "Third Party Advisory"
              ],
              "url": "https://github.com/Cacti/cacti/blob/develop/CHANGELOG"
            },
            {
              "name": "openSUSE-SU-2020:0272",
              "refsource": "SUSE",
              "tags": [],
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00001.html"
            },
            {
              "name": "openSUSE-SU-2020:0284",
              "refsource": "SUSE",
              "tags": [],
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00005.html"
            },
            {
              "name": "openSUSE-SU-2020:0558",
              "refsource": "SUSE",
              "tags": [],
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00042.html"
            },
            {
              "name": "openSUSE-SU-2020:0565",
              "refsource": "SUSE",
              "tags": [],
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00048.html"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "acInsufInfo": false,
          "cvssV2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "availabilityImpact": "NONE",
            "baseScore": 3.5,
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
            "version": "2.0"
          },
          "exploitabilityScore": 6.8,
          "impactScore": 2.9,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "LOW",
          "userInteractionRequired": true
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.0"
          },
          "exploitabilityScore": 2.3,
          "impactScore": 2.7
        }
      },
      "lastModifiedDate": "2020-03-01T22:15Z",
      "publishedDate": "2019-01-16T16:29Z"
    }
  }
}

OPENSUSE-SU-2020:0272-1

Vulnerability from csaf_opensuse - Published: 2020-03-01 17:12 - Updated: 2020-03-01 17:12

Summary

Security update for cacti, cacti-spine

Severity

Important

Scope

10 vulnerabilities in this advisory, including CVE-2018-20726.

CVE-2018-20726

5.4 (Medium)


                
                  CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Recommended: 2 products

Open the full advisory

OPENSUSE-SU-2020:0284-1

Vulnerability from csaf_opensuse - Published: 2020-03-02 12:20 - Updated: 2020-03-02 12:20

Summary

Security update for cacti, cacti-spine

Severity

Important

Scope

10 vulnerabilities in this advisory, including CVE-2018-20726.

CVE-2018-20726

5.4 (Medium)


                
                  CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Recommended: 5 products

Open the full advisory

OPENSUSE-SU-2020:0558-1

Vulnerability from csaf_opensuse - Published: 2020-04-27 18:18 - Updated: 2020-04-27 18:18

Summary

Security update for cacti, cacti-spine

Severity

Important

Scope

11 vulnerabilities in this advisory, including CVE-2018-20726.

CVE-2018-20726

5.4 (Medium)


                
                  CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Recommended: 10 products

Open the full advisory

OPENSUSE-SU-2020:0565-1

Vulnerability from csaf_opensuse - Published: 2020-04-30 15:35 - Updated: 2020-04-30 15:35

Summary

Security update for cacti, cacti-spine

Severity

Important

Scope

11 vulnerabilities in this advisory, including CVE-2018-20726.

CVE-2018-20726

5.4 (Medium)


                
                  CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Recommended: 5 products

Open the full advisory

OPENSUSE-SU-2024:10670-1

Vulnerability from csaf_opensuse - Published: 2024-06-15 00:00 - Updated: 2024-06-15 00:00

Summary

cacti-1.2.18-1.2 on GA media

Severity

Moderate

Scope

31 vulnerabilities in this advisory, including CVE-2018-20726.

CVE-2018-20726

5.4 (Medium)


                
                  CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Recommended: 4 products

Open the full advisory

ubuntu-cve-2018-20726

Vulnerability from osv_ubuntu

Published

2019-01-16 16:29

Modified

2025-09-08 16:45

Summary

Details

A cross-site scripting (XSS) vulnerability exists in host.php (via tree.php) in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Website Hostname field for Devices.

Severity

5.4 (Medium)


                    
                      CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2018-20726	REPORT
	https://github.com/Cacti/cacti/commit/80c2a88fb2a…	REPORT
	https://github.com/Cacti/cacti/issues/2213	REPORT
	https://github.com/Cacti/cacti/blob/develop/CHANGELOG	REPORT
	https://www.cve.org/CVERecord?id=CVE-2018-20726	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "cacti",
            "binary_version": "0.8.8b+dfsg-5ubuntu0.2+esm2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:14.04:LTS",
        "name": "cacti",
        "purl": "pkg:deb/ubuntu/cacti@0.8.8b+dfsg-5ubuntu0.2+esm2?arch=source\u0026distro=esm-infra-legacy/trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.8.8b+dfsg-3",
        "0.8.8b+dfsg-5",
        "0.8.8b+dfsg-5ubuntu0.1",
        "0.8.8b+dfsg-5ubuntu0.2",
        "0.8.8b+dfsg-5ubuntu0.2+esm1",
        "0.8.8b+dfsg-5ubuntu0.2+esm2"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "cacti",
            "binary_version": "0.8.8f+ds1-4ubuntu4.16.04.2+esm2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:16.04:LTS",
        "name": "cacti",
        "purl": "pkg:deb/ubuntu/cacti@0.8.8f+ds1-4ubuntu4.16.04.2+esm2?arch=source\u0026distro=esm-apps/xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.8.8f+ds1-2",
        "0.8.8f+ds1-3",
        "0.8.8f+ds1-4",
        "0.8.8f+ds1-4ubuntu1",
        "0.8.8f+ds1-4ubuntu2",
        "0.8.8f+ds1-4ubuntu3",
        "0.8.8f+ds1-4ubuntu4",
        "0.8.8f+ds1-4ubuntu4.16.04",
        "0.8.8f+ds1-4ubuntu4.16.04.1",
        "0.8.8f+ds1-4ubuntu4.16.04.2",
        "0.8.8f+ds1-4ubuntu4.16.04.2+esm1",
        "0.8.8f+ds1-4ubuntu4.16.04.2+esm2"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "cacti",
            "binary_version": "1.1.38+ds1-1ubuntu0.1~esm4"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:18.04:LTS",
        "name": "cacti",
        "purl": "pkg:deb/ubuntu/cacti@1.1.38+ds1-1ubuntu0.1~esm4?arch=source\u0026distro=esm-apps/bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.1.18+ds1-1",
        "1.1.27+ds1-2",
        "1.1.27+ds1-3",
        "1.1.28+ds1-2",
        "1.1.35+ds1-1",
        "1.1.36+ds1-1",
        "1.1.38+ds1-1",
        "1.1.38+ds1-1ubuntu0.1~esm1",
        "1.1.38+ds1-1ubuntu0.1~esm3",
        "1.1.38+ds1-1ubuntu0.1~esm4"
      ]
    }
  ],
  "aliases": [],
  "details": "A cross-site scripting (XSS) vulnerability exists in host.php (via tree.php) in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Website Hostname field for Devices.",
  "id": "UBUNTU-CVE-2018-20726",
  "modified": "2025-09-08T16:45:07Z",
  "published": "2019-01-16T16:29:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2018-20726"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/Cacti/cacti/commit/80c2a88fb2afb93f87703ba4641f9970478c102d"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/Cacti/cacti/issues/2213"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/Cacti/cacti/blob/develop/CHANGELOG"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-20726"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2018-20726"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2018-20726 (GCVE-0-2018-20726)

Vulnerability from osv_ubuntu

Tags

Sightings

Nomenclature