CVE-2023-49088
CVSS 3.1 Score 4.8 of 10 (medium)
Details
Summary
CVE-2023-49088 is a new cross-site scripting (XSS) vulnerability affecting Cacti, an open-source operational monitoring framework. Despite the release of a patch for a previous vulnerability (CVE-2023-39515) in version 1.2.25, the fix is incomplete. Hovering a mouse over a malicious data source path in `data_debug.php` can lead an adversary to execute malicious code in a victim's browser. To exploit this vulnerability, an attacker must be an authorized Cacti user with specific permissions: `General Administration > Sites/Devices/Data`. The risk posed by this flaw is significant, as any account with permission to access `http://<HOST>/cacti/data_debug.php` can potentially fall victim to this attack. At the time of publication, a complete fix has yet to be implemented within Cacti.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Affected Products
- Cacti
- Cacti Cacti
Affected Vendors
- Cacti
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions