PT-2023-9153 · Cacti+1 · Cacti+1

012Git012 · Published 2023-11-08 · Updated 2024-06-15 · CVE-2023-49086

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Cacti versions prior to 1.2.27

Description The issue is related to the lack of protection of the web page structure, allowing a remote attacker to conduct a cross-site scripting (XSS) attack and execute arbitrary code. The vulnerable component is the graphs new.php file. Exploitation of the vulnerability is possible for an authorized user, leading to the execution of arbitrary JavaScript code in the attacked user's browser.

Recommendations For versions prior to 1.2.27, update to version 1.2.27 to resolve the issue. As a temporary workaround, consider restricting access to the graphs new.php file until the update is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

ALT-PU-2023-8407

ALT-PU-2024-1003

BDU:2024-04203

CVE-2023-49086

DLA-3765-1

DSA-5646-1

GHSA-WC73-R2VW-59PR

OPENSUSE-SU-2024:0031-1

OPENSUSE-SU-2024:13533-1

Affected Products

Alt Linux

Cacti

References · 33

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/49xxx/CVE-2023-49086.json · Exploit
• 🔥 https://github.com/Cacti/cacti/security/advisories/GHSA-wc73-r2vw-59pr · Exploit
• https://github.com/Cacti/cacti/commit/6ec01c8b2983bf4fcb86f8c647655f74090b5be9 · Patch
• https://osv.dev/vulnerability/openSUSE-SU-2024:13533-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:0031-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-49086 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3765-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/RBEOAFKRARQHTDIYSL723XAFJ2Q6624X · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-49086 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-49086 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-49086 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-49086 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-49086 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5646-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-49086 · Vendor Advisory