CVE-2021-26247
published 2022-01-19CVE-2021-26247: As an unauthenticated remote user, visit "http:///auth_changepassword.php?ref=alert(1)" to successfully execute the JavaScript payload present in the "ref" URL…
PriorityP347medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EXPLOIT
EPSS
7.12%
93.5th percentile
As an unauthenticated remote user, visit "http:///auth_changepassword.php?ref=alert(1)" to successfully execute the JavaScript payload present in the "ref" URL parameter.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cacti | cacti | — | — |
| cacti | cacti | >= 0 < 0.8.7i-1 | 0.8.7i-1 |
| cacti | cacti | >= 0 < 0.8.7i-1 | 0.8.7i-1 |
| cacti | cacti | >= 0 < 0.8.7i-1 | 0.8.7i-1 |
| cacti | cacti | >= 0 < 0.8.7i-1 | 0.8.7i-1 |
| debian | cacti | < cacti 0.8.7i-1 (bookworm) | cacti 0.8.7i-1 (bookworm) |
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
osv6.1MEDIUM
vendor_debian6.1MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-cvpj-w72w-rchg: As an unauthenticated remote user, visit "http:///auth_changepassword
ghsa_unreviewed·2022-01-20
CVE-2021-26247 [MEDIUM] CWE-79 GHSA-cvpj-w72w-rchg: As an unauthenticated remote user, visit "http:///auth_changepassword
As an unauthenticated remote user, visit "http:///auth_changepassword.php?ref=alert(1)" to successfully execute the JavaScript payload present in the "ref" URL parameter.
OSV
CVE-2021-26247: As an unauthenticated remote user, visit "http:///auth_changepassword
osv·2022-01-19·CVSS 6.1
CVE-2021-26247 [MEDIUM] CVE-2021-26247: As an unauthenticated remote user, visit "http:///auth_changepassword
As an unauthenticated remote user, visit "http:///auth_changepassword.php?ref=alert(1)" to successfully execute the JavaScript payload present in the "ref" URL parameter.
Debian
CVE-2021-26247: cacti - As an unauthenticated remote user, visit "http://<CACTI_SERVER>/auth_changepassw...
vendor_debian·2021·CVSS 6.1
CVE-2021-26247 [MEDIUM] CVE-2021-26247: cacti - As an unauthenticated remote user, visit "http://<CACTI_SERVER>/auth_changepassw...
As an unauthenticated remote user, visit "http:///auth_changepassword.php?ref=alert(1)" to successfully execute the JavaScript payload present in the "ref" URL parameter.
Scope: local
bookworm: resolved (fixed in 0.8.7i-1)
bullseye: resolved (fixed in 0.8.7i-1)
forky: resolved (fixed in 0.8.7i-1)
sid: resolved (fixed in 0.8.7i-1)
trixie: resolved (fixed in 0.8.7i-1)
No detection rules found.
Nuclei
Cacti - Cross-Site Scripting
nuclei·CVSS 6.1
CVE-2021-26247 [MEDIUM] Cacti - Cross-Site Scripting
Cacti - Cross-Site Scripting
Cacti contains a cross-site scripting vulnerability via "http:///auth_changepassword.php?ref=alert(1)" which can successfully execute the JavaScript payload present in the "ref" URL parameter.
Template:
id: CVE-2021-26247
info:
name: Cacti - Cross-Site Scripting
author: dhiyaneshDK
severity: medium
description: Cacti contains a cross-site scripting vulnerability via "http:///auth_changepassword.php?ref=alert(1)" which can successfully execute the JavaScript payload present in the "ref" URL parameter.
impact: |
Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser, leading to session hijacking, defacement, or theft of sensitive information.
remediation: |
Apply the la
2022-01-19
Published