CVE-2022-48547 — Cross-site Scripting in Cacti

CWE-79 — Cross-site Scripting4 documents4 sources

Severity

6.1MEDIUMNVD

EPSS

0.5%

top 35.54%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Cacti Debian Cacti

Timeline

PublishedAug 22

Description

A reflected cross-site scripting (XSS) vulnerability in Cacti 0.8.7g and earlier allows unauthenticated remote attackers to inject arbitrary web script or HTML in the "ref" parameter at auth_changepassword.php.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages3 packages

▶debiandebian/cacti< cacti 0.8.7i-1 (bookworm)

▶Debiancacti/cacti< 0.8.7i-1+3

▶NVDcacti/cacti0.8.7g

🔴Vulnerability Details

OSV

CVE-2022-48547: A reflected cross-site scripting (XSS) vulnerability in Cacti 0↗2023-08-22

▶

GHSA

GHSA-56hw-m8c6-f8jg: A reflected cross-site scripting (XSS) vulnerability in Cacti 0↗2023-08-22

▶

📋Vendor Advisories

Debian

CVE-2022-48547: cacti - A reflected cross-site scripting (XSS) vulnerability in Cacti 0.8.7g and earlier...↗2022

▶