CVE-2024-31443: Cacti XSS vulnerability in lib/html_tree.php by reading dirty data stored in database
Cacti provides an operational monitoring and fault management framework. Prior to 1.2.27, some of the data stored in formsave() function in dataqueries.php is not thoroughly checked and is used to concatenate the HTML statement in growrightpanetree() function from lib/html.php , finally resulting in cross-site scripting. Version 1.2.27 contains a patch for the issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-31443?
CVE-2024-31443 is considered a moderate security vulnerability due to improper data validation that could lead to potential code injection.
How do I fix CVE-2024-31443?
To fix CVE-2024-31443, update Cacti to version 1.2.27 or later, ensuring all previous versions are not in use.
What versions of Cacti are affected by CVE-2024-31443?
CVE-2024-31443 affects all Cacti versions prior to 1.2.27.
Is CVE-2024-31443 related to data queries in Cacti?
Yes, CVE-2024-31443 involves vulnerabilities related to the data stored and processed within the form_save() function in Cacti.
What are the potential risks of CVE-2024-31443?
The risks associated with CVE-2024-31443 include unauthorized access and potential manipulation of the application through code injection.