CVE-2023-39516mediumCWE-79

CVE-2023-39516: medium-severity vulnerability in cacti

Stored Cross-Site-Scripting on data_sources.php debug html-block in Cacti

Published · Updated

Follow this CVE+ Monitor cacti+ Monitor cacti

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.1epss 0.8%
Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting (XSS) Vulnerability which allows an authenticated user to poison data stored in the _cacti_'s database. These data will be viewed by administrative _cacti_ accounts and execute JavaScript code in the victim's browser at view-time. The script under `data_sources.php` displays the data source management information (e.g. data source path, polling configuration etc.) for different data visualizations of the _cacti_ app. CENSUS found that an adversary that is able to configure a malicious data-source path, can deploy a stored XSS attack against any user of the same (or broader) privileges. A user that possesses the 'General Administration>Sites/Devices/Data' permissions can configure the data source path in Cacti. This configuration occurs through `http://<HOST>/cacti/data_sources.php`. The same page can be used for previewing the data source path. This issue has been addressed in version 1.2.25. Users are advised to upgrade. Users unable to upgrade should manually escape HTML output.
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N
Affected products
Cacti · cacti
Related CVEs — cacti

In the same product, most dangerous first.

CVE-2022-46169CRITICALUnauthenticated Command InjectionEPSS 99.8%KEVCVE-2024-29895CRITICALCacti command injection in cmd_realtime.phpEPSS 98.8%CVE-2023-39361CRITICALUnauthenticated SQL Injection in graph_view.php in CactiEPSS 88.8%CVE-2024-25641CRITICALCacti RCE vulnerability when importing packagesEPSS 86.3%CVE-2023-39362HIGHAuthenticated command injection in SNMP options of a DeviceEPSS 85.4%CVE-2023-49085HIGHCacti SQL Injection vulnerabilityEPSS 74.5%