Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2020-25706: Cacti template import can run malicious code

CVE-2020-25706 · published 5 years ago

Summary

The Cacti monitoring tool (version 1.2.13) does not properly clean up error messages when previewing a template import. An attacker could insert harmful script code that runs in a user's browser, potentially stealing data or changing settings. Update Cacti to the latest version or apply the provided patch to fix the input handling.

What to do

Update debian cacti to version 1.2.14+ds1-1.

Affected software

Ecosystem	Vendor	Product	Affected versions
Debian:12	debian	cacti	< 1.2.14+ds1-1 Fix: upgrade to 1.2.14+ds1-1
Debian:13	debian	cacti	< 1.2.14+ds1-1 Fix: upgrade to 1.2.14+ds1-1
Debian:14	debian	cacti	< 1.2.14+ds1-1 Fix: upgrade to 1.2.14+ds1-1
–	cacti	cacti	1.2.13 `cpe:2.3:a:cacti:cacti:1.2.13:::::::*`
–	debian	debian_linux	10.0 `cpe:2.3:o:debian:debian_linux:10.0:::::::*`

Original advisory text

A cross-site scripting (XSS) vulnerability exists in templates_import.php (Cacti 1.2.13) due to Improper escaping of error message during template import preview in the xml_path field

References

https://security-tracker.debian.org/tracker/CVE-2020-25706 Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-25706 Exploit Issue Tracking Patch Third Party Advisory
https://github.com/Cacti/cacti/commit/39458efcd5286d50e6b7f905fedcdc1059354e6e Patch Third Party Advisory
https://github.com/Cacti/cacti/issues/3723 Exploit Issue Tracking Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/12/msg00039.html Mailing List Third Party Advisory

Severity

6.1 Medium

Exploitation

3% chance of attack within 30 days

Type

CWE-79Cross-site Scripting (XSS)

Timeline

Published12 Nov 2020

Updated30 Oct 2026

First seen11 Sep 2026

Sources

DEBIAN-CVE-2020-25706 · OSV

CVE-2020-25706 · NVD

Track software like this

Free during beta