vulnerability

SUSE: CVE-2023-49088: SUSE Linux Security Advisory

Severity
4
CVSS
(AV:N/AC:M/Au:M/C:P/I:P/A:N)
Published
Dec 22, 2023
Added
Jan 25, 2024
Modified
Jan 28, 2025

Description

Cacti is an open source operational monitoring and fault management framework. The fix applied for CVE-2023-39515 in version 1.2.25 is incomplete as it enables an adversary to have a victim browser execute malicious code when a victim user hovers their mouse over the malicious data source path in `data_debug.php`. To perform the cross-site scripting attack, the adversary needs to be an authorized cacti user with the following permissions: `General Administration>Sites/Devices/Data`. The victim of this attack could be any account with permissions to view `http:///cacti/data_debug.php`. As of time of publication, no complete fix has been included in Cacti.

Solution(s)

suse-upgrade-cactisuse-upgrade-cacti-spine
Title
NEW

Explore Exposure Command

Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.