PT-2023-5429 · Cacti · Cacti

Enferas · Publicado 2023-08-22 · Atualizado 2024-09-09 · CVE-2022-41444

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cacti version 1.2.21

Description The issue is related to a Cross Site Scripting (XSS) vulnerability. It can be exploited via a crafted POST request to the "graphs new.php" endpoint. This vulnerability may allow a remote attacker to perform inter-site script attacks.

Recommendations For Cacti version 1.2.21, consider disabling access to the "graphs new.php" endpoint until a patch is available. Restricting the use of this endpoint can help minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

BDU:2023-06059

CVE-2022-41444

DLA-3884-1

Produtos afetados

Cacti

Referências · 46

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/cacti_package_import_rce.rb · Exploit
• 🔥 https://github.com/thisisveryfunny/CVE-2024-25641-RCE-Automated-Exploit-Cacti-1.2.26 · Exploit
• 🔥 https://github.com/5ma1l/CVE-2024-25641 · Exploit
• 🔥 https://github.com/StopThatTalace/CVE-2024-25641-CACTI-RCE-1.2.26 · Exploit
• 🔥 https://github.com/XiaomingX/cve-2024-25641-poc · Exploit
• 🔥 https://gist.github.com/enferas/9079535112e4f4ff2c1d2ce1c099d4c2 · Exploit
• https://github.com/Cacti/cacti/security/advisories/GHSA-cx8g-hvq8-p2rv · Nota
• https://github.com/Cacti/cacti/security/advisories/GHSA-pfh9-gwm6-86vp · Nota
• https://github.com/Cacti/cacti/security/advisories/GHSA-vjph-r677-6pcc · Nota
• https://github.com/Cacti/cacti/security/advisories/GHSA-37x7-mfjv-mm7m · Nota
• https://github.com/Cacti/cacti/security/advisories/GHSA-rqc8-78cm-85j3 · Nota
• https://github.com/Cacti/cacti/security/advisories/GHSA-jrxg-8wh8-943x · Nota
• https://github.com/Cacti/cacti/security/advisories/GHSA-gj3f-p326-gh8r · Nota
• https://github.com/Cacti/cacti/security/advisories/GHSA-7cmj-g5qc-pj88 · Nota
• https://github.com/Cacti/cacti/security/advisories/GHSA-p4ch-7hjw-6m87 · Nota