CVE-2024-43364

Name
CVE-2024-43364
Description
Cacti is an open source performance and fault management framework. The `title` parameter is not properly sanitized when saving external links in links.php . Morever, the said title parameter is stored in the database and reflected back to user in index.php, finally leading to stored XSS. Users with the privilege to create external links can manipulate the `title` parameter in the http post request while creating external links to perform stored XSS attacks. The vulnerability known as XSS (Cross-Site Scripting) occurs when an application allows untrusted user input to be displayed on a web page without proper validation or escaping. This issue has been addressed in release version 1.2.28. All users are advised to upgrade. There are no known workarounds for this vulnerability.
NVD Severity
medium
Other trackers
Mailing lists
Exploits
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
CONFIRM https://github.com/Cacti/cacti/security/advisories/GHSA-fgc6-g8gc-wcg5

Match rules

CPE URI Source package Min version Max version
cacti >= 0 < 1.2.28
cpe:2.3:a:cacti:cacti:*:*:*:*:*:*:*:* cacti >= 0 < 1.2.28

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
cacti edge-community 1.2.27-r0 Jeff Bilyk <jbilyk@gmail.com> possibly vulnerable
cacti 3.20-community 1.2.27-r0 Jeff Bilyk <jbilyk@gmail.com> possibly vulnerable