Stored Cross-site Scripting (XSS) when creating external links in Cacti

CVE-2024-43362

What is CVE-2024-43362?

The Cacti framework, utilized for performance and fault management, contains a vulnerability due to improper sanitization of the 'fileurl' parameter in 'links.php'. This flaw allows users with the privilege to create external links to inject malicious scripts, leading to stored XSS attacks. These injections can be executed whenever external links are rendered, posing a significant risk to users accessing the affected functionalities. The issue has been resolved in version 1.2.28, and users are strongly encouraged to upgrade immediately, as no workarounds are available to mitigate this risk.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References