CVE-2024-31444CWE-79

Cacti XSS vulnerability in lib/html.php by reading dirty data stored in database

Medium · published May 13, 2024

CVSS v3.1

4.6

EPSS

15%

Percentile

96.7

In the wild

Unconfirmed

What it is

Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, some of the data stored in `automation_tree_rules_form_save()` function in `automation_tree_rules.php` is not thoroughly checked and is used to concatenate the HTML statement in `form_confirm()` function from `lib/html.php` , finally resulting in cross-site scripting. Version 1.2.27 contains a patch for the issue.

The record

Technical detail

CVSS v3.1: 4.6 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L
CVSS v4.0: Not supplied
EPSS: 0.14664 · 96.7th percentile
Weakness: CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published: 2024-05-13T15:03Z

EPSS history

Timeline

13 MAY 15:03Z
Cacti XSS vulnerability in lib/html.php by reading dirty data stored in database
cvelistv5