CVE-2024-29894 Cacti Cross-site Scripting vulnerability when using JavaScript based messaging API

2024-05-1314:24:32

CWE-79

CWE-116

GitHub_M

github.com

cacti

cross-site scripting

javascript

api

vulnerability

cve-2024-29894

unauthorized changes

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

AI Score

6.3

Confidence

High

EPSS

0.001

Percentile

20.6%

SSVC

Exploitation

none

Automatable

Technical Impact

partial

JSON

Cacti provides an operational monitoring and fault management framework. Versions of Cacti prior to 1.2.27 contain a residual cross-site scripting vulnerability caused by an incomplete fix for CVE-2023-50250. raise_message_javascript from lib/functions.php now uses purify.js to fix CVE-2023-50250 (among others). However, it still generates the code out of unescaped PHP variables $title and $header. If those variables contain single quotes, they can be used to inject JavaScript code. An attacker exploiting this vulnerability could execute actions on behalf of other users. This ability to impersonate users could lead to unauthorized changes to settings. Version 1.2.27 fixes this issue.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:cacti:cacti:-:*:*:*:*:*:*:*"
    ],
    "vendor": "cacti",
    "product": "cacti",
    "versions": [
      {
        "status": "affected",
        "version": "-",
        "lessThan": "1.2.27",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  }
]