Stored Cross-site Scripting (XSS) when creating external links in Cacti

CVE-2024-43362

What is CVE-2024-43362?

The Cacti framework, utilized for performance and fault management, contains a vulnerability due to improper sanitization of the 'fileurl' parameter in 'links.php'. This flaw allows users with the privilege to create external links to inject malicious scripts, leading to stored XSS attacks. These injections can be executed whenever external links are rendered, posing a significant risk to users accessing the affected functionalities. The issue has been resolved in version 1.2.28, and users are strongly encouraged to upgrade immediately, as no workarounds are available to mitigate this risk.

References