CVE-2023-39364: Open redirect in change password functionality in Cacti
Cacti is an open source operational monitoring and fault management framework. In Cacti 1.2.24, users with console access can be redirected to an arbitrary website after a change password performed via a specifically crafted URL. The authchangepassword.php file accepts ref as a URL parameter and reflects it in the form used to perform the change password. It's value is used to perform a redirect via header PHP function. A user can be tricked in performing the change password operation, e.g., via a phishing message, and then interacting with the malicious website where the redirection has been performed, e.g., downloading malwares, providing credentials, etc. This issue has been addressed in version 1.2.25. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-39364?
CVE-2023-39364 is a vulnerability in Cacti 1.2.24 that allows users with console access to be redirected to an arbitrary website after a change password is performed via a specifically crafted URL.
How does CVE-2023-39364 affect Cacti?
CVE-2023-39364 affects Cacti 1.2.24, allowing users with console access to be redirected to an arbitrary website after changing their password with a specially crafted URL.
What is the severity of CVE-2023-39364?
CVE-2023-39364 has a severity keyword of 'medium' and a severity value of 5.4.
How can I fix CVE-2023-39364?
To fix CVE-2023-39364, update your Cacti installation to version 1.2.25 or later, which includes a patch for this vulnerability.
Where can I find more information about CVE-2023-39364?
More information about CVE-2023-39364 can be found on the GitHub security advisory page: [https://github.com/Cacti/cacti/security/advisories/GHSA-4pjv-rmrp-r59x](https://github.com/Cacti/cacti/security/advisories/GHSA-4pjv-rmrp-r59x)