What’s Vulnerable › Vulnerabilities

CVE-2019-11025

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2019-04-08 · updated 2026-06-17
• Weakness: CWE-79

Description

In clearFilter() in utilities.php in Cacti before 1.2.3, no escaping occurs before printing out the value of the SNMP community string (SNMP Options) in the View poller cache, leading to XSS.

Affected products

• cacti: before 1.2.3 — fixed in 1.2.3
• Debian Linux: 8.0, 9.0

How to fix

Upgrade to a fixed version: cacti 1.2.3. Check the vendor advisory for mitigations.

References

• https://github.com/Cacti/cacti/compare/6ea486a...99995bb
• https://github.com/Cacti/cacti/issues/2581
• https://lists.debian.org/debian-lts-announce/2019/04/msg00017.html
• https://lists.debian.org/debian-lts-announce/2022/03/msg00038.html
• https://github.com/Cacti/cacti/compare/6ea486a...99995bb
• https://github.com/Cacti/cacti/issues/2581
• https://lists.debian.org/debian-lts-announce/2019/04/msg00017.html
• https://lists.debian.org/debian-lts-announce/2022/03/msg00038.html

Get alerted when CVE-2019-11025 or the next vulnerability affects your stack