SecuriTricks - CVE-2024-29894

Description

Cacti provides an operational monitoring and fault management framework. Versions of Cacti prior to 1.2.27 contain a residual cross-site scripting vulnerability caused by an incomplete fix for CVE-2023-50250. `raise_message_javascript` from `lib/functions.php` now uses purify.js to fix CVE-2023-50250 (among others). However, it still generates the code out of unescaped PHP variables `$title` and `$header`. If those variables contain single quotes, they can be used to inject JavaScript code. An attacker exploiting this vulnerability could execute actions on behalf of other users. This ability to impersonate users could lead to unauthorized changes to settings. Version 1.2.27 fixes this issue.

Product(s) Impacted

Product	Versions
Cacti	before 1.2.27

Weaknesses

Common security weaknesses mapped to this vulnerability.

References

https://github.com/Cacti/cacti/security/advisories/GHSA-grj5-8fcj-34gh

https://github.com/Cacti/cacti/security/advisories/GHSA-xwqc-7jc4-xm73

CVSS Score

5.4 / 10

CVSS Data - 3.1

Attack Vector: NETWORK
Attack Complexity: LOW
Privileges Required: NONE
Scope: UNCHANGED
Confidentiality Impact: NONE
Integrity Impact: LOW
Availability Impact: LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

View Vector String

Timeline

Published: May 14, 2024, 3:17 p.m.
Last Modified: May 14, 2024, 4:13 p.m.

Status : Awaiting Analysis

CVE has been marked for Analysis. Normally once in this state the CVE will be analyzed by NVD staff within 24 hours.

More info

Source

security-advisories@github.com

CVE-2024-29894