CVE-2021-23225: XSS
Cacti 1.1.38 allows authenticated users with User Management permissions to inject arbitrary web script or HTML in the "newusername" field during creation of a new user via "Copy" method at useradmin.php.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-23225?
CVE-2021-23225 is a vulnerability in Cacti 1.1.38 that allows authenticated users with User Management permissions to inject arbitrary web script or HTML in the "new_username" field during creation of a new user via "Copy" method at user_admin.php.
How does CVE-2021-23225 affect Cacti?
CVE-2021-23225 affects Cacti 1.1.38 installations where authenticated users with User Management permissions can inject arbitrary web script or HTML in the "new_username" field when creating a new user via the "Copy" method at user_admin.php.
What is the severity of CVE-2021-23225?
CVE-2021-23225 has a severity rating of 5.4 (Medium).
How can I fix CVE-2021-23225 in Cacti?
To fix CVE-2021-23225 in Cacti, update to version 1.1.39 or apply the necessary patches provided by the vendor.
What is CWE-79?
CWE-79 is a common weakness enumeration category for Improper Neutralization of Input During Web Page Generation (Cross-site Scripting).