We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Zendesk (Helpdesk and Chat)
Ok

THREATINT
PUBLISHED

CVE-2024-30268

Cacti XSS vulnerability in display_settings

Reserved:2024-03-26
Published:2024-05-13
Updated:2024-05-13

Description

Cacti provides an operational monitoring and fault management framework. A reflected cross-site scripting vulnerability on the 1.3.x DEV branch allows attackers to obtain cookies of administrator and other users and fake their login using obtained cookies. This issue is fixed in commit a38b9046e9772612fda847b46308f9391a49891e.



MEDIUM: 6.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Problem types

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Product status

= 1.3.x DEV
affected

References

https://github.com/Cacti/cacti/security/advisories/GHSA-9m3v-whmr-pc2q

https://github.com/Cacti/cacti/commit/a38b9046e9772612fda847b46308f9391a49891e

https://github.com/Cacti/cacti/blob/08497b8bcc6a6037f7b1aae303ad8f7dfaf7364e/settings.php#L66

cve.org CVE-2024-30268

nvd.nist.gov CVE-2024-30268

Download JSON

Share this page
https://cve.threatint.com/CVE/CVE-2024-30268