Tayfunyelim

**Name of the Vulnerable Software and Affected Versions** Cacti versions prior to 1.2.29 **Description** The issue concerns an open-source performance and fault management framework. An administrator can modify the `Poller Standard Error Log Path` parameter to point to a local file on the server, allowing its content to be displayed on the web UI. This can lead to unauthorized access to sensitive information. The vulnerability is fixed in version 1.2.29. **Recommendations** For versions prior to 1.2.29, update to version 1.2.29 to resolve the issue. As a temporary workaround, consider restricting access to the `Poller Standard Error Log Path` parameter to prevent unauthorized modifications.

Name of the Vulnerable Software and Affected Versions: Cacti versions prior to 1.2.28 Description: The issue is related to incorrect code generation management in the Cacti network monitoring tool. An admin user can create a device with a malicious hostname containing PHP code, allowing for log poisoning and potentially leading to Remote Code Execution (RCE). This can be achieved by completing only step 5 of the installation process. The estimated number of potentially affected devices worldwide is not provided. There are no known real-world incidents where this issue was exploited. Recommendations: For versions prior to 1.2.28, upgrade to version 1.2.28 or later to address the issue. As a temporary workaround, consider restricting access to the log files to minimize the risk of exploitation. Avoid using malicious hostnames containing PHP code in the device creation process until the issue is resolved.

Name of the Vulnerable Software and Affected Versions: Cacti versions prior to 1.2.28 Description: The issue is related to the lack of protection of the web page structure in the Cacti network monitoring tool, specifically in the links.php script. This allows a remote attacker to perform cross-site scripting attacks. The `fileurl` parameter is not properly sanitized when saving external links, leading to stored XSS. Users with the privilege to create external links can manipulate the `fileurl` parameter to perform stored XSS attacks. This occurs when an application allows untrusted user input to be displayed on a web page without proper validation or escaping. Recommendations: For versions prior to 1.2.28, upgrade to release version 1.2.28 to address the issue. As a temporary workaround, consider restricting access to the `links.php` script and limiting the ability to create external links to trusted users only. Avoid using the `fileurl` parameter in the HTTP post request while creating external links until the issue is resolved.

Name of the Vulnerable Software and Affected Versions: Cacti versions prior to 1.2.28 Description: The issue arises from the improper sanitization of the `title` parameter when saving external links in links.php, which is then stored in the database and reflected back to the user in index.php, leading to stored XSS. Users with the privilege to create external links can manipulate the `title` parameter in the HTTP POST request to perform stored XSS attacks. This occurs when an application allows untrusted user input to be displayed on a web page without proper validation or escaping. Recommendations: For versions prior to 1.2.28, upgrade to release version 1.2.28 to address the issue. As a temporary workaround, consider restricting access to the `title` parameter in the links.php file to minimize the risk of exploitation. Additionally, restrict the privilege to create external links to trusted users only.

**Name of the Vulnerable Software and Affected Versions** Cacti versions prior to 1.2.28 **Description** The issue arises from the improper sanitization of the `consolenewsection` parameter when saving external links in links.php, which is then stored in the database and reflected back to the user in index.php, leading to stored XSS. Users with the privilege to create external links can manipulate the `consolenewsection` parameter in the HTTP post request to perform stored XSS attacks. This occurs when an application allows untrusted user input to be displayed on a web page without proper validation or escaping. **Recommendations** For versions prior to 1.2.28, upgrade to release version 1.2.28 to address the issue. As a temporary workaround, consider restricting access to the `consolenewsection` parameter in links.php to minimize the risk of exploitation. Additionally, restrict the ability for users to create external links until the issue is resolved.