PT-2022-9380 · Cacti · Cacti

Published 2022-01-19 · Updated 2022-05-24 · CVE-2021-23225

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Cacti version 1.1.38

Description The issue allows authenticated users with User Management permissions to inject arbitrary web script or HTML in the new username field during creation of a new user via the "Copy" method at the "user admin.php" endpoint.

Recommendations For Cacti version 1.1.38, consider restricting access to the "Copy" method in user admin.php to prevent exploitation until a fix is available. As a temporary workaround, avoid using the new username field for user creation until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-23225

DLA-2965-1

Affected Products

Cacti

References · 11

• https://security-tracker.debian.org/tracker/CVE-2021-23225 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-23225 · Security Note
• https://cacti.net/info/changelog · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-23225 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-23225 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-23225 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-23225 · Security Note
• https://osv.dev/vulnerability/DLA-2965-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-23225 · Vendor Advisory
• https://t.me/cibsecurity/35897 · Telegram Post
• https://lists.debian.org/debian-lts-announce/2022/03/msg00038.html · Note