CVE-2024-31444

Summary

CVE-2024-31444 affects the Cacti network monitoring system, which permits cross-site scripting (XSS) attacks. The vulnerability arises from the `automation_tree_rules_form_save()` function in `automation_tree_rules.php`, where input data is not sufficiently validated before being used to construct HTML statements within the `form_confirm()` function in `lib/html.php`. This flaw can enable attackers to inject malicious scripts into web pages viewed by other users. The vulnerability is mitigated by the release of version 1.2.27, which provides a patch to address the issue.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.