Log in Start free

Vulnerability · Published Sep 5, 2023 · Assigned by GitHub_M

CVE-2023-39516Stored Cross-Site-Scripting on data_sources.php debug html-block in Cacti

Medium 6.1

In plain English

A medium-severity cross-site scripting in cacti from Cacti. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 58% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.1Medium
Exploit odds (30 days)0.8%top 41.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting (XSS) Vulnerability which allows an authenticated user to poison data stored in the _cacti_'s database. These data will be viewed by administrative _cacti_ accounts and execute JavaScript code in the victim's browser at view-time. The script under `data_sources.php` displays the data source management information (e.g. data source path, polling configuration etc.) for different data visualizations of the _cacti_ app. CENSUS found that an adversary that is able to configure a malicious data-source path, can deploy a stored XSS attack against any user of the same (or broader) privileges. A user that possesses the 'General Administration>Sites/Devices/Data' permissions can configure the data source path in Cacti. This configuration occurs through `http://<HOST>/cacti/data_sources.php`. The same page can be used for previewing the data source path. This issue has been addressed in version 1.2.25. Users are advised to upgrade. Users unable to upgrade should manually escape HTML output.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20cacti1.2.25-r0ALPINE-CVE-2023-39516
Alpine:v3.21cacti1.2.25-r0ALPINE-CVE-2023-39516
Alpine:v3.22cacti1.2.25-r0ALPINE-CVE-2023-39516
Alpine:v3.23cacti1.2.25-r0ALPINE-CVE-2023-39516
Alpine:v3.24cacti1.2.25-r0ALPINE-CVE-2023-39516
Debian:12cacti1.2.24+ds1-1+deb12u1DEBIAN-CVE-2023-39516
Debian:12cacti1.2.24+ds1-1+deb12u1DSA-5550-1
Debian:13cacti1.2.25+ds1-1DEBIAN-CVE-2023-39516
Debian:14cacti1.2.25+ds1-1DEBIAN-CVE-2023-39516
Ubuntu:24.04:LTScactino fix listedUBUNTU-CVE-2023-39516

Affected products (as reported)

VendorProductVersions
Cacti cacti < 1.2.25

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N

References