cbcvebase.
CVE-2023-50250
published 2023-12-22

CVE-2023-50250: Cacti is an open source operational monitoring and fault management framework. A reflection cross-site scripting vulnerability was discovered in version…

PriorityP428medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
1.28%
67.0th percentile
Cacti is an open source operational monitoring and fault management framework. A reflection cross-site scripting vulnerability was discovered in version 1.2.25. Attackers can exploit this vulnerability to perform actions on behalf of other users. The vulnerability is found in `templates_import.php.` When uploading an xml template file, if the XML file does not pass the check, the server will give a JavaScript pop-up prompt, which contains unfiltered xml template file name, resulting in XSS. An attacker exploiting this vulnerability could execute actions on behalf of other users. This ability to impersonate users could lead to unauthorized changes to settings. As of time of publication, no patched versions are available.

Affected

12 ranges
VendorProductVersion rangeFixed in
cacticacti< 1.2.271.2.27
cacticacti< 1.2.271.2.27
cacticacti——
cacticacti>= 0 < 1.2.24+ds1-1+deb12u21.2.24+ds1-1+deb12u2
cacticacti>= 0 < 1.2.24+ds1-1+deb12u31.2.24+ds1-1+deb12u3
cacticacti>= 0 < 1.2.26+ds1-11.2.26+ds1-1
cacticacti>= 0 < 1.2.27+ds1-11.2.27+ds1-1
cacticacti>= 0 < 1.2.26+ds1-11.2.26+ds1-1
cacticacti>= 0 < 1.2.27+ds1-11.2.27+ds1-1
debiancacti< cacti 1.2.24+ds1-1+deb12u2 (bookworm)cacti 1.2.24+ds1-1+deb12u2 (bookworm)
debiancacti< cacti 1.2.24+ds1-1+deb12u3 (bookworm)cacti 1.2.24+ds1-1+deb12u3 (bookworm)
fedoraprojectfedora——

CVSS provenance

nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
osv6.1MEDIUM
vendor_debian5.4MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.