CVE-2023-39360: Reflected Cross-site Scripting in graphs_new.php in Cacti
Cacti is an open source operational monitoring and fault management framework.Affected versions are subject to a Stored Cross-Site-Scripting (XSS) Vulnerability allows an authenticated user to poison data. The vulnerability is found in graphsnew.php. Several validations are performed, but the returnto parameter is directly passed to formsavebutton. In order to bypass this validation, returnto must contain host.php. This vulnerability has been addressed in version 1.2.25. Users are advised to upgrade. Users unable to update should manually filter HTML output.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-39360 vulnerability?
CVE-2023-39360 is a Stored Cross-Site Scripting (XSS) vulnerability found in the Cacti open source operational monitoring and fault management framework.
How can an authenticated user exploit this vulnerability?
An authenticated user can exploit the CVE-2023-39360 vulnerability by poisoning data through the `graphs_new.php` file.
What is the severity of CVE-2023-39360?
CVE-2023-39360 has a severity level of medium (6.1).
Which versions of Cacti are affected by CVE-2023-39360?
The CVE-2023-39360 vulnerability affects Cacti version 1.2.24.
How can I fix the CVE-2023-39360 vulnerability?
To fix the CVE-2023-39360 vulnerability, update Cacti to a version that is not affected by the vulnerability.