Stored Cross-site Scripting (XSS) when creating external links in Cacti

CVE-2024-43364

What is CVE-2024-43364?

A vulnerability exists within the Cacti performance and fault management framework related to the improper sanitization of the 'title' parameter in the links.php file. When users with the privilege to create external links submit their input, the unsanitized 'title' is stored in the database and reflected back to users in index.php, enabling the possibility of stored Cross-Site Scripting (XSS) attacks. This flaw allows attackers to leverage untrusted user input to execute malicious scripts in the context of the user’s session. The issue has been resolved in release version 1.2.28, and all users are strongly encouraged to upgrade their installations to ensure protection against this vulnerability, as there are currently no viable workarounds.

References