[Pkg-cacti-maint] Bug#926700: cacti: CVE-2019-11025

[Salvatore Bonaccorso]

Source: cacti
Version: 1.2.2+ds1-1
Severity: important
Tags: security upstream
Forwarded: https://github.com/Cacti/cacti/issues/2581

Hi,

The following vulnerability was published for cacti.

CVE-2019-11025[0]:
| In clearFilter() in utilities.php in Cacti before 1.2.3, no escaping
| occurs before printing out the value of the SNMP community string
| (SNMP Options) in the View poller cache, leading to XSS.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2019-11025
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11025
[1] https://github.com/Cacti/cacti/issues/2581

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore