CVE-2024-30268 | THREATINT

Assigner	GitHub_M
Reserved	2024-03-26
Published	2024-05-13
Updated	2024-06-04

Description

Cacti provides an operational monitoring and fault management framework. A reflected cross-site scripting vulnerability on the 1.3.x DEV branch allows attackers to obtain cookies of administrator and other users and fake their login using obtained cookies. This issue is fixed in commit a38b9046e9772612fda847b46308f9391a49891e.

MEDIUM: 6.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Problem types

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Product status

= 1.3.x DEV

affected

References

https://github.com/Cacti/cacti/security/advisories/GHSA-9m3v-whmr-pc2q

https://github.com/Cacti/cacti/commit/a38b9046e9772612fda847b46308f9391a49891e

https://github.com/Cacti/cacti/blob/08497b8bcc6a6037f7b1aae303ad8f7dfaf7364e/settings.php#L66

cve.org CVE-2024-30268

nvd.nist.gov CVE-2024-30268

Download JSON