CVE-2024-30268CWE-79

Cacti XSS vulnerability in display_settings

Medium · published May 13, 2024

CVSS v3.1
6.1
EPSS
1%
Percentile
47.5
In the wild
Unconfirmed
What it is

Cacti provides an operational monitoring and fault management framework. A reflected cross-site scripting vulnerability on the 1.3.x DEV branch allows attackers to obtain cookies of administrator and other users and fake their login using obtained cookies. This issue is fixed in commit a38b9046e9772612fda847b46308f9391a49891e.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00590 · 47.5th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2024-05-13T14:56Z
EPSS history
Timeline
  • 13 MAY 14:56Z
    Cacti XSS vulnerability in display_settings
    cvelistv5