CVE-2023-49088: cacti Cross-site Scripting

Vulnerability summary

CVE-2023-49088 is a medium (CVSS 6.1) Cross-site Scripting vulnerability in cacti. EPSS estimates a 1.27% chance of exploitation in the next 30 days, higher than 69.3% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 22-12-2023
   PublishedVulnerability first disclosed.
2. 25-02-2026
   Last modifiedVulnerability information updated.

Description

Cacti is an open source operational monitoring and fault management framework. The fix applied for CVE-2023-39515 in version 1.2.25 is incomplete as it enables an adversary to have a victim browser execute malicious code when a victim user hovers their mouse over the malicious data source path in `data_debug.php`. To perform the cross-site scripting attack, the adversary needs to be an authorized cacti user with the following permissions: `General Administration>Sites/Devices/Data`. The victim of this attack could be any account with permissions to view `http://<HOST>/cacti/data_debug.php`. As of time of publication, no complete fix has been included in Cacti.

• CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.