CVE-2023-39516
CVSS 3.1 Score 4.8 of 10 (medium)
Details
Summary
CVE-2023-39516 is a Stored Cross-Site-Scripting (XSS) vulnerability affecting versions of Cacti, an open-source operational monitoring framework. This issue allows authenticated users to inject malicious JavaScript code into the _cacti_ database, which is then executed in the victim's browser when viewing affected data. The vulnerability is located in the `data_sources.php` file, which manages data source paths and configurations for various Cacti visualizations. An attacker who can configure a malicious data source path can launch a stored XSS attack against any user with similar or broader privileges, potentially gaining unauthorized access or executing malicious code. The vulnerability has been addressed in version 1.2.25. Users unable to upgrade are advised to manually escape HTML output as a mitigation measure.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Affected Products
- Cacti
- Cacti Cacti
- Fedora Operating System
Affected Vendors
- Fedora Project
- Cacti
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions