Cacti is an open source operational monitoring and fault management framework. A reflection cross-site scripting vulnerability was discovered in version 1.2.25. Attackers can exploit this vulnerability to perform actions on behalf of other users. The vulnerability is found in `templates_import.php.` When uploading an xml template file, if the XML file does not pass the check, the server will give a JavaScript pop-up prompt, which contains unfiltered xml template file name, resulting in XSS. An attacker exploiting this vulnerability could execute actions on behalf of other users. This ability to impersonate users could lead to unauthorized changes to settings. As of time of publication, no patched versions are available.
References
Configurations
History
10 Apr 2025, 20:31
Type | Values Removed | Values Added |
---|---|---|
References | () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RBEOAFKRARQHTDIYSL723XAFJ2Q6624X/ - Release Notes |
13 Feb 2025, 18:15
Type | Values Removed | Values Added |
---|---|---|
Summary | (en) Cacti is an open source operational monitoring and fault management framework. A reflection cross-site scripting vulnerability was discovered in version 1.2.25. Attackers can exploit this vulnerability to perform actions on behalf of other users. The vulnerability is found in `templates_import.php.` When uploading an xml template file, if the XML file does not pass the check, the server will give a JavaScript pop-up prompt, which contains unfiltered xml template file name, resulting in XSS. An attacker exploiting this vulnerability could execute actions on behalf of other users. This ability to impersonate users could lead to unauthorized changes to settings. As of time of publication, no patched versions are available. |
21 Nov 2024, 08:36
Type | Values Removed | Values Added |
---|---|---|
CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.4 |
References | () https://github.com/Cacti/cacti/blob/5f6f65c215d663a775950b2d9db35edbaf07d680/templates_import.php - Exploit, Vendor Advisory | |
References | () https://github.com/Cacti/cacti/security/advisories/GHSA-xwqc-7jc4-xm73 - Exploit, Vendor Advisory | |
References | () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RBEOAFKRARQHTDIYSL723XAFJ2Q6624X/ - |
10 Jun 2024, 17:16
Type | Values Removed | Values Added |
---|---|---|
References |
|
|
Summary | (es) Cacti es un framework de gestión de fallos y monitoreo operativo de código abierto. Se descubrió una vulnerabilidad de cross-site scripting reflejado en la versión 1.2.25. Los atacantes pueden aprovechar esta vulnerabilidad para realizar acciones en nombre de otros usuarios. La vulnerabilidad se encuentra en `templates_import.php.` Al cargar un archivo de plantilla xml, si el archivo XML no pasa la verificación, el servidor mostrará un mensaje emergente de JavaScript, que contiene el nombre del archivo de plantilla xml sin filtrar, lo que resulta en XSS. Un atacante que aproveche esta vulnerabilidad podría ejecutar acciones en nombre de otros usuarios. Esta capacidad de hacerse pasar por usuarios podría dar lugar a cambios no autorizados en la configuración. Al momento de la publicación, no hay versiones parcheadas disponibles. |
29 Dec 2023, 19:28
Type | Values Removed | Values Added |
---|---|---|
Summary |
|
|
CPE | cpe:2.3:a:cacti:cacti:1.2.25:*:*:*:*:*:*:* | |
First Time |
Cacti
Cacti cacti |
|
CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.1 |
References | () https://github.com/Cacti/cacti/blob/5f6f65c215d663a775950b2d9db35edbaf07d680/templates_import.php - Exploit, Vendor Advisory | |
References | () https://github.com/Cacti/cacti/security/advisories/GHSA-xwqc-7jc4-xm73 - Exploit, Vendor Advisory |
22 Dec 2023, 17:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2023-12-22 17:15
Updated : 2025-04-10 20:31
NVD link : CVE-2023-50250
Mitre link : CVE-2023-50250
CVE.ORG link : CVE-2023-50250
JSON object : View
Products Affected
cacti
- cacti
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')