CVE-2024-27082 Cacti Cross-site Scripting vulnerability when managing trees

2024-05-1313:49:10

CWE-79

GitHub_M

github.com

cacti

cross-site scripting

vulnerability

version 1.2.27

CVSS3

7.6

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:H

AI Score

Confidence

High

EPSS

Percentile

9.0%

SSVC

Exploitation

poc

Automatable

Technical Impact

partial

JSON

Cacti provides an operational monitoring and fault management framework. Versions of Cacti prior to 1.2.27 are vulnerable to stored cross-site scripting, a type of cross-site scripting where malicious scripts are permanently stored on a target server and served to users who access a particular page. Version 1.2.27 contains a patch for the issue.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:cacti:cacti:-:*:*:*:*:*:*:*"
    ],
    "vendor": "cacti",
    "product": "cacti",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "1.2.27",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  }
]