CVE-2024-30268

Cacti XSS vulnerability in display_settings

CVSS 6.1 MEDIUMEPSS 0.6%CWE-79

Vexday Risk Score

13Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 6.1EPSS 0.6%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

13 May 2024Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

Cacti provides an operational monitoring and fault management framework. A reflected cross-site scripting vulnerability on the 1.3.x DEV branch allows attackers to obtain cookies of administrator and other users and fake their login using obtained cookies. This issue is fixed in commit a38b9046e9772612fda847b46308f9391a49891e.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected products

Cacti · cacti

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://github.com/Cacti/cacti/blob/08497b8bcc6a6037f7b1aae303ad8f7dfaf7364e/settings.php#L66 https://github.com/Cacti/cacti/commit/a38b9046e9772612fda847b46308f9391a49891e https://github.com/Cacti/cacti/security/advisories/GHSA-9m3v-whmr-pc2q