PT-2024-5188 · Cacti+3 · Cacti+3
Ishgard-2
·
Published
2023-07-13
·
Updated
2025-01-24
·
CVE-2024-31444
CVSS v2.0
5.5
Medium
| Vector | AV:N/AC:L/Au:S/C:N/I:P/A:P |
Name of the Vulnerable Software and Affected Versions:
Cacti versions prior to 1.2.27
Description:
Cacti provides an operational monitoring and fault management framework. The issue arises from the
automation tree rules form save() function in automation tree rules.php, where some data is not thoroughly checked and is used to concatenate the HTML statement in the form confirm() function from lib/html.php, resulting in cross-site scripting.Recommendations:
For versions prior to 1.2.27, update to version 1.2.27 or later, as it contains a patch for the issue.
As a temporary workaround, consider disabling the
automation tree rules form save() function until a patch is available.
Restrict access to the automation tree rules.php file to minimize the risk of exploitation.
Avoid using the form confirm() function from lib/html.php with unverified data until the issue is resolved.Exploit
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Cacti
Linuxmint
Ubuntu