CVE-2017-12066

Name: CVE-2017-12066
Creator: NVD / NIST
Published: 2017-08-01T05:29:00.29+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

UnknownEPSS 1.42%

Last modified Jun 17, 2026

CVE-2017-12066 is a vulnerability of currently unknown severity. Cross-site scripting (XSS) vulnerability in aggregate_graphs.php in Cacti before 1.1.16 allows remote authenticated users to inject arbitrary web script or HTML via specially crafted HTTP Referer headers, related to the $cancel_url variable. NOTE: this vulnerability exists because of an incomplete fix (lack of the htmlspecialchars ENT_QUOTES flag) for CVE-2017-11163.. EPSS estimates a 1.42% chance of exploitation in the next 30 days.

Description

Cross-site scripting (XSS) vulnerability in aggregate_graphs.php in Cacti before 1.1.16 allows remote authenticated users to inject arbitrary web script or HTML via specially crafted HTTP Referer headers, related to the $cancel_url variable. NOTE: this vulnerability exists because of an incomplete fix (lack of the htmlspecialchars ENT_QUOTES flag) for CVE-2017-11163.

Metrics

EPSS Probability

1.42%

69.4th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-79

Affected Software

Vendor	Product	Versions
Cacti	Cacti	<= 1.1.15

References

https://cacti.net/release_notes.php?version=1.1.16Release Notes, Vendor Advisory
https://github.com/Cacti/cacti/commit/bd0e586f6f46d814930226f1516a194e7e72293eIssue Tracking, Patch, Third Party Advisory
https://github.com/Cacti/cacti/issues/877Issue Tracking, Patch, Third Party Advisory
https://cacti.net/release_notes.php?version=1.1.16Release Notes, Vendor Advisory
https://github.com/Cacti/cacti/commit/bd0e586f6f46d814930226f1516a194e7e72293eIssue Tracking, Patch, Third Party Advisory
https://github.com/Cacti/cacti/issues/877Issue Tracking, Patch, Third Party Advisory

Timeline

Published: Aug 1, 2017
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2017-12066?

How severe is CVE-2017-12066?

Severity scoring for CVE-2017-12066 is pending analysis. The EPSS model estimates a 1.42% probability of exploitation in the next 30 days.

How do I fix CVE-2017-12066?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2017-12066?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST