Log in Start free

Vulnerability · Published Sep 5, 2023 · Assigned by GitHub_M

CVE-2023-39364Open redirect in change password functionality in Cacti

Low 3.5

In plain English

A low-severity open redirect in cacti from Cacti. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 55% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)3.5Low
Exploit odds (30 days)0.7%top 44.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

Cacti is an open source operational monitoring and fault management framework. In Cacti 1.2.24, users with console access can be redirected to an arbitrary website after a change password performed via a specifically crafted URL. The `auth_changepassword.php` file accepts `ref` as a URL parameter and reflects it in the form used to perform the change password. It's value is used to perform a redirect via `header` PHP function. A user can be tricked in performing the change password operation, e.g., via a phishing message, and then interacting with the malicious website where the redirection has been performed, e.g., downloading malwares, providing credentials, etc. This issue has been addressed in version 1.2.25. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20cacti1.2.25-r0ALPINE-CVE-2023-39364
Alpine:v3.21cacti1.2.25-r0ALPINE-CVE-2023-39364
Alpine:v3.22cacti1.2.25-r0ALPINE-CVE-2023-39364
Alpine:v3.23cacti1.2.25-r0ALPINE-CVE-2023-39364
Alpine:v3.24cacti1.2.25-r0ALPINE-CVE-2023-39364
Debian:12cacti1.2.24+ds1-1+deb12u1DEBIAN-CVE-2023-39364
Debian:12cacti1.2.24+ds1-1+deb12u1DSA-5550-1
Debian:13cacti1.2.25+ds1-1DEBIAN-CVE-2023-39364
Debian:14cacti1.2.25+ds1-1DEBIAN-CVE-2023-39364
Ubuntu:24.04:LTScactino fix listedUBUNTU-CVE-2023-39364

Affected products (as reported)

VendorProductVersions
Cacti cacti < 1.2.25

Weakness: CWE-601 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

References