CVE-2023-49086

Name
CVE-2023-49086
Description
Cacti is a robust performance and fault management framework and a frontend to RRDTool - a Time Series Database (TSDB). Bypassing an earlier fix (CVE-2023-39360) that leads to a DOM XSS attack. Exploitation of the vulnerability is possible for an authorized user. The vulnerable component is the `graphs_new.php`. Impact of the vulnerability - execution of arbitrary javascript code in the attacked user's browser. This issue has been patched in version 1.2.26.
NVD Severity
unknown
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
security-advisories@github.com https://github.com/Cacti/cacti/security/advisories/GHSA-wc73-r2vw-59pr
security-advisories@github.com https://lists.debian.org/debian-lts-announce/2024/03/msg00018.html

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:cacti:cacti:1.2.25:*:*:*:*:*:*:* cacti == None == 1.2.25

Vulnerable and fixed packages

Source package Branch Version Maintainer Status