CVE-2023-39364
CVSS 3.1 Score 5.4 of 10 (medium)
Details
Summary
CVE-2023-39364 is a vulnerability affecting the Cacti monitoring framework, version 1.2.24. This issue allows an attacker to redirect users who change their passwords through a specially crafted URL to an arbitrary website. The `auth_changepassword.php` file uses the URL's `ref` parameter in a `header` function to perform the redirect. Users can be tricked into performing the password change and interacting with the malicious website, potentially leading to malware downloads or credential theft. The vulnerability is patched in version 1.2.25. Users are advised to upgrade as soon as possible, and there are no known workarounds for this issue.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Affected Products
- Fedora Operating System
- Cacti
Affected Vendors
- Fedora Project
- Cacti
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions