PT-2023-4936 · Cacti+1 · Cacti+1
Vissamoutafis
·
Published
2023-09-05
·
Updated
2025-01-24
·
CVE-2023-39513
CVSS v2.0
8.5
High
| Vector | AV:N/AC:L/Au:S/C:C/I:C/A:N |
Name of the Vulnerable Software and Affected Versions
Cacti versions prior to 1.2.25
Description
Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting (XSS) Vulnerability which allows an authenticated user to poison data stored in the Cacti database. These data will be viewed by administrative Cacti accounts and execute JavaScript code in the victim's browser at view-time. The script under
host.php is used to monitor and manage hosts in the Cacti app, hence displays useful information such as data queries and verbose logs. An adversary that is able to configure a data-query template with malicious code appended in the template path can deploy a stored XSS attack against any user with the General Administration>Sites/Devices/Data privileges. This configuration occurs through http://<HOST>/cacti/data queries.php by editing an existing or adding a new data query template. If a template is linked to a device then the formatted template path will be rendered in the device's management page, when a verbose data query is requested.Recommendations
For versions prior to 1.2.25, upgrade to version 1.2.25 or later to resolve the issue.
As a temporary workaround for users unable to update, manually filter HTML output.
Consider restricting access to the
data queries.php page to minimize the risk of exploitation.
Avoid using the http://<HOST>/cacti/data queries.php endpoint to edit or add new data query templates until the issue is resolved.Exploit
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Cacti