The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
Cacti is an open source operational monitoring and fault management framework.Affected versions are subject to a Stored Cross-Site-Scripting (XSS) Vulnerability allows an authenticated user to poison data. The vulnerability is found in `graphs_new.php`. Several validations are performed, but the `returnto` parameter is directly passed to `form_save_button`. In order to bypass this validation, returnto must contain `host.php`. This vulnerability has been addressed in version 1.2.25. Users are advised to upgrade. Users unable to update should manually filter HTML output.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade cacti | Aug 22, 2024 | Sep 5, 2023 |
| Debian | — | Upgrade cacti | Mar 20, 2024 | Sep 5, 2023 |
| Gentoo Linux | — | Upgrade net-analyzer/cacti. | Dec 9, 2024 | Sep 5, 2023 |
| Suse | — | Upgrade cacti-spineUpgrade cacti | Sep 27, 2023 | Sep 5, 2023 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub