CVE-2017-12066 Amazon Linux Security Advisory for cacti: ALAS-2017-874

spikekill.php in Cacti before 1.1.16 might allow remote attackers to execute arbitrary code via the avgnan, outlier-start, or outlier-end parameter. (CVE-2017-12065 )

Cross-site scripting (XSS) vulnerability in aggregate_graphs.php in Cacti before 1.1.16 allows remote authenticated users to inject arbitrary web script or HTML via specially crafted HTTP Referer headers, related to the $cancel_url variable. NOTE: this vulnerability exists because of an incomplete fix (lack of the htmlspecialchars ENT_QUOTES flag) for CVE-2017-11163 . (CVE-2017-12066 )

QID Detection Logic:
This authenticated QID verifies if the version of the following files is lesser than 1.1.16-1.16.amzn1: cacti

Allows unauthorized disclosure of information; allows unauthorized modification; allows disruption of service.

Please refer to Amazon advisory ALAS-2017-874 for affected packages and patching details, or update with your package manager.

Patch:
Following are links for downloading patches to fix the vulnerabilities:

ALAS-2017-874: Amazon Linux (cacti (1.1.16-1.16.amzn1) on src)

ALAS-2017-874: Amazon Linux (cacti (1.1.16-1.16.amzn1) on noarch)