CVE-2024-30268 — Cross-site Scripting in Cacti

CWE-79 — Cross-site Scripting3 documents3 sources
Severity
6.1MEDIUMNVD
EPSS
0.1%
top 65.17%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
CactiDebian Cacti
Timeline
PublishedMay 14

Description

Cacti provides an operational monitoring and fault management framework. A reflected cross-site scripting vulnerability on the 1.3.x DEV branch allows attackers to obtain cookies of administrator and other users and fake their login using obtained cookies. This issue is fixed in commit a38b9046e9772612fda847b46308f9391a49891e.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages2 packages

▶CVEListV5cacti/cacti= 1.3.x DEV
▶debiandebian/cacti

🔴Vulnerability Details

1
OSV
CVE-2024-30268: Cacti provides an operational monitoring and fault management framework↗2024-05-14
▶

📋Vendor Advisories

1
Debian
CVE-2024-30268: cacti - Cacti provides an operational monitoring and fault management framework. A refle...↗2024
▶