CVE-2024-43362: cacti Cross-site Scripting

Vulnerability summary

CVE-2024-43362 is a high (CVSS 7.3) Cross-site Scripting vulnerability in cacti. EPSS estimates a 38.57% chance of exploitation in the next 30 days, higher than 98.5% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 07-10-2024
   PublishedVulnerability first disclosed.
2. 03-11-2025
   Last modifiedVulnerability information updated.

Description

Cacti is an open source performance and fault management framework. The `fileurl` parameter is not properly sanitized when saving external links in `links.php` . Morever, the said fileurl is placed in some html code which is passed to the `print` function in `link.php` and `index.php`, finally leading to stored XSS. Users with the privilege to create external links can manipulate the `fileurl` parameter in the http post request while creating external links to perform stored XSS attacks. The vulnerability known as XSS (Cross-Site Scripting) occurs when an application allows untrusted user input to be displayed on a web page without proper validation or escaping. This issue has been addressed in release version 1.2.28. All users are advised to upgrade. There are no known workarounds for this issue.

• CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.