Cacti XSS vulnerability in display_settings
CVE-2024-30268

6.1MEDIUM

Key Information:

Vendor

Cacti

Status
Cacti
Vendor
CVE Published:
14 May 2024

What is CVE-2024-30268?

Cacti provides an operational monitoring and fault management framework. A reflected cross-site scripting vulnerability on the 1.3.x DEV branch allows attackers to obtain cookies of administrator and other users and fake their login using obtained cookies. This issue is fixed in commit a38b9046e9772612fda847b46308f9391a49891e.

Affected Version(s)

cacti = 1.3.x DEV

References

https://github.com/Cacti/cacti/security/advisories/GHSA-9...
x_refsource_CONFIRM
https://github.com/Cacti/cacti/commit/a38b9046e9772612fda...
x_refsource_MISC
https://github.com/Cacti/cacti/blob/08497b8bcc6a6037f7b1a...
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.