Multiple cross-site scripting (XSS) vulnerabilities in Cacti 0.8.7 before 0.8.7b and 0.8.6 before 0.8.6k allow remote attackers to inject arbitrary web script or HTML via (1) the view_type parameter to graph.php; (2) the filter parameter to graph_view.php; (3) the action parameter to the draw_navigation_text function in lib/functions.php, reachable through index.php (aka the login page) or data_input.php; or (4) the login_username parameter to index.php.
| Software | From | Fixed in |
|---|---|---|
| cacti / cacti | 0.6.7 | 0.6.7.x |
| cacti / cacti | 0.8 | 0.8.x |
| cacti / cacti | 0.8.1 | 0.8.1.x |
| cacti / cacti | 0.8.2 | 0.8.2.x |
| cacti / cacti | 0.8.2a | 0.8.2a.x |
| cacti / cacti | 0.8.3 | 0.8.3.x |
| cacti / cacti | 0.8.3a | 0.8.3a.x |
| cacti / cacti | 0.8.4 | 0.8.4.x |
| cacti / cacti | 0.8.5 | 0.8.5.x |
| cacti / cacti | 0.8.5a | 0.8.5a.x |
| cacti / cacti | 0.8.6c | 0.8.6c.x |
| cacti / cacti | 0.8.6f | 0.8.6f.x |
| cacti / cacti | 0.8.6i | 0.8.6i.x |
| cacti / cacti | 0.8.6j | 0.8.6j.x |
| cacti / cacti | 0.8.7 | 0.8.7.x |
| cacti / cacti | 0.8.7a | 0.8.7a.x |