CVE-2023-39360 Common Vulnerabilities and Exposures

Upstream information

CVE-2023-39360 at MITRE

Description

Cacti is an open source operational monitoring and fault management framework.Affected versions are subject to a Stored Cross-Site-Scripting (XSS) Vulnerability allows an authenticated user to poison data. The vulnerability is found in `graphs_new.php`. Several validations are performed, but the `returnto` parameter is directly passed to `form_save_button`. In order to bypass this validation, returnto must contain `host.php`. This vulnerability has been addressed in version 1.2.25. Users are advised to upgrade. Users unable to update should manually filter HTML output.

SUSE information

Overall state of this security issue: Resolved

This issue is currently rated as having moderate severity.

CVSS v3 Scores
	National Vulnerability Database
Base Score	6.1
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack Vector	Network
Attack Complexity	Low
Privileges Required	None
User Interaction	Required
Scope	Changed
Confidentiality Impact	Low
Integrity Impact	Low
Availability Impact	None
CVSSv3 Version	3.1

SUSE Bugzilla entries: 1215044 [RESOLVED / FIXED], 1218366 [RESOLVED / FIXED]

SUSE Security Advisories:

openSUSE-SU-2023:0275-1, published Tue Sep 26 22:45:11 2023

List of released packages

Product(s)	Fixed package version(s)	References
SUSE Package Hub 12	`cacti >= 1.2.25-35.1` `cacti-spine >= 1.2.25-29.1`	Patchnames: openSUSE-2023-275
SUSE Package Hub 15 SP4	`cacti >= 1.2.25-bp154.2.9.1` `cacti-spine >= 1.2.25-bp154.2.9.1`	Patchnames: openSUSE-2023-275
SUSE Package Hub 15 SP5	`cacti >= 1.2.25-bp155.2.3.1` `cacti-spine >= 1.2.25-bp155.2.3.1`	Patchnames: openSUSE-2023-275
openSUSE Leap 15.4	`cacti >= 1.2.25-bp154.2.9.1` `cacti-spine >= 1.2.25-bp154.2.9.1`	Patchnames: openSUSE-2023-275
openSUSE Leap 15.5	`cacti >= 1.2.25-bp155.2.3.1` `cacti-spine >= 1.2.25-bp155.2.3.1`	Patchnames: openSUSE-2023-275
openSUSE Tumbleweed	`cacti >= 1.2.25-2.1`	Patchnames: openSUSE Tumbleweed GA cacti-1.2.25-2.1

SUSE Timeline for this CVE

CVE page created: Wed Sep 6 00:00:07 2023
CVE page last modified: Tue Jan 30 16:38:23 2024