CVE-2024-30268

Published: May 14, 2024Modified: Jun 17, 2026Deferred

6.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: security-advisories@github.com (Secondary)

Description

Cacti provides an operational monitoring and fault management framework. A reflected cross-site scripting vulnerability on the 1.3.x DEV branch allows attackers to obtain cookies of administrator and other users and fake their login using obtained cookies. This issue is fixed in commit a38b9046e9772612fda847b46308f9391a49891e.

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (6)

https://github.com/Cacti/cacti/blob/08497b8bcc6a6037f7b1aae303ad8f7dfaf7364e/settings.php#L66

Source: security-advisories@github.com

https://github.com/Cacti/cacti/commit/a38b9046e9772612fda847b46308f9391a49891e

Source: security-advisories@github.com

https://github.com/Cacti/cacti/security/advisories/GHSA-9m3v-whmr-pc2q

Source: security-advisories@github.com

https://github.com/Cacti/cacti/blob/08497b8bcc6a6037f7b1aae303ad8f7dfaf7364e/settings.php#L66

Source: af854a3a-2127-422b-91ae-364da2661108

https://github.com/Cacti/cacti/commit/a38b9046e9772612fda847b46308f9391a49891e

Source: af854a3a-2127-422b-91ae-364da2661108

https://github.com/Cacti/cacti/security/advisories/GHSA-9m3v-whmr-pc2q

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.