CVE-2024-31443: cacti Cross-site Scripting
Vulnerability summary
CVE-2024-31443 is a medium (CVSS 5.7) Cross-site Scripting vulnerability in cacti. EPSS estimates a 0.84% chance of exploitation in the next 30 days, higher than 57.3% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 5 · Related 4Timeline
- 13-05-2024PublishedVulnerability first disclosed.
- 04-11-2025Last modifiedVulnerability information updated.
Description
Cacti provides an operational monitoring and fault management framework. Prior to 1.2.27, some of the data stored in `form_save()` function in `data_queries.php` is not thoroughly checked and is used to concatenate the HTML statement in `grow_right_pane_tree()` function from `lib/html.php` , finally resulting in cross-site scripting. Version 1.2.27 contains a patch for the issue.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated5.7MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated5.4MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NDiffers
- NVDNIST5.4MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NDiffers
EPSS trend
Probability
0.84%
Chance of exploitation in the next 30 days
Percentile
57%
Versus all other CVEs
30-day change
0.00 pp
From 0.84% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundCacti
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Cacti1 product
- cacti< 1.2.27
Debian1 product
- cacti< 1.2.24+ds1-1+deb12u3 | < 1.2.27+ds1-1
Fedoraproject1 product
- fedoraEOL39
Ubuntu1 product
- cacti< 0.8.8b+dfsg-5ubuntu0.2+esm2 | < 0.8.8f+ds1-4ubuntu4.16.04.2+esm2 | < 1.1.38+ds1-1ubuntu0.1~esm3 | < 1.2.10+ds1-1ubuntu1.1 | < 1.2.19+ds1-2ubuntu1.1 | < 1.2.26+ds1-1ubuntu0.1
4 vendors · 4 products
References
8 links- github.com/Cacti/cacti/security/advisories/GHSA-rqc8-78cm-85j3X Refsource CONFIRMREPORTExploitVendor Advisory
