CVE-2023-39514

Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting (XSS) Vulnerability which allows an authenticated user to poison data stored in the cacti's database. These data will be viewed by administrative cacti accounts and execute JavaScript code in the victim's browser at view-time. The script under graphs.php displays graph details such as data-source paths, data template information and graph related fields. CENSUS found that an adversary that is able to configure either a data-source template with malicious code appended in the data-source name or a device with a malicious payload injected in the device name, may deploy a stored XSS attack against any user with General Administration>Graphs privileges. A user that possesses the Template Editor>Data Templates permissions can configure the data-source name in cacti. Please note that this may be a low privileged user. This configuration occurs through http://<HOST>/cacti/data_templates.php by editing an existing or adding a new data template. If a template is linked to a graph then the formatted template name will be rendered in the graph's management page. A user that possesses the General Administration>Sites/Devices/Data permissions can configure the device name in cacti. This vulnerability has been addressed in version 1.2.25. Users are advised to upgrade. Users unable to upgrade should add manual HTML escaping.

Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting (XSS) Vulnerability which allows an authenticated user to poison data stored in the cacti's database. These data will be viewed by administrative cacti accounts and execute JavaScript code in the victim's browser at view-time. The script under graphs.php displays graph details such as data-source paths, data template information and graph related fields. CENSUS found that an adversary that is able to configure either a data-source template with malicious code appended in the data-source name or a device with a malicious payload injected in the device name, may deploy a stored XSS attack against any user with General Administration>Graphs privileges. A user that possesses the Template Editor>Data Templates permissions can configure the data-source name in cacti. Please note that this may be a low privileged user. This configuration occurs through http://<HOST>/cacti/data_templates.php by editing an existing or adding a new data template. If a template is linked to a graph then the formatted template name will be rendered in the graph's management page. A user that possesses the General Administration>Sites/Devices/Data permissions can configure the device name in cacti. This vulnerability has been addressed in version 1.2.25. Users are advised to upgrade. Users unable to upgrade should add manual HTML escaping.

Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting (XSS) Vulnerability which allows an authenticated user to poison data stored in the cacti's database. These data will be viewed by administrative cacti accounts and execute JavaScript code in the victim's browser at view-time. The script under graphs.php displays graph details such as data-source paths, data template information and graph related fields. CENSUS found that an adversary that is able to configure either a data-source template with malicious code appended in the data-source name or a device with a malicious payload injected in the device name, may deploy a stored XSS attack against any user with General Administration>Graphs privileges. A user that possesses the Template Editor>Data Templates permissions can configure the data-source name in cacti. Please note that this may be a low privileged user. This configuration occurs through http://<HOST>/cacti/data_templates.php by editing an existing or adding a new data template. If a template is linked to a graph then the formatted template name will be rendered in the graph's management page. A user that possesses the General Administration>Sites/Devices/Data permissions can configure the device name in cacti. This vulnerability has been addressed in version 1.2.25. Users are advised to upgrade. Users unable to upgrade should add manual HTML escaping.

Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting (XSS) Vulnerability which allows an authenticated user to poison data stored in the cacti's database. These data will be viewed by administrative cacti accounts and execute JavaScript code in the victim's browser at view-time. The script under graphs.php displays graph details such as data-source paths, data template information and graph related fields. CENSUS found that an adversary that is able to configure either a data-source template with malicious code appended in the data-source name or a device with a malicious payload injected in the device name, may deploy a stored XSS attack against any user with General Administration>Graphs privileges. A user that possesses the Template Editor>Data Templates permissions can configure the data-source name in cacti. Please note that this may be a low privileged user. This configuration occurs through http://<HOST>/cacti/data_templates.php by editing an existing or adding a new data template. If a template is linked to a graph then the formatted template name will be rendered in the graph's management page. A user that possesses the General Administration>Sites/Devices/Data permissions can configure the device name in cacti. This vulnerability has been addressed in version 1.2.25. Users are advised to upgrade. Users unable to upgrade should add manual HTML escaping.

Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting (XSS) Vulnerability which allows an authenticated user to poison data stored in the cacti's database. These data will be viewed by administrative cacti accounts and execute JavaScript code in the victim's browser at view-time. The script under graphs.php displays graph details such as data-source paths, data template information and graph related fields. CENSUS found that an adversary that is able to configure either a data-source template with malicious code appended in the data-source name or a device with a malicious payload injected in the device name, may deploy a stored XSS attack against any user with General Administration>Graphs privileges. A user that possesses the Template Editor>Data Templates permissions can configure the data-source name in cacti. Please note that this may be a low privileged user. This configuration occurs through http://<HOST>/cacti/data_templates.php by editing an existing or adding a new data template. If a template is linked to a graph then the formatted template name will be rendered in the graph's management page. A user that possesses the General Administration>Sites/Devices/Data permissions can configure the device name in cacti. This vulnerability has been addressed in version 1.2.25. Users are advised to upgrade. Users unable to upgrade should add manual HTML escaping.

Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting (XSS) Vulnerability which allows an authenticated user to poison data stored in the cacti's database. These data will be viewed by administrative cacti accounts and execute JavaScript code in the victim's browser at view-time. The script under graphs.php displays graph details such as data-source paths, data template information and graph related fields. CENSUS found that an adversary that is able to configure either a data-source template with malicious code appended in the data-source name or a device with a malicious payload injected in the device name, may deploy a stored XSS attack against any user with General Administration>Graphs privileges. A user that possesses the Template Editor>Data Templates permissions can configure the data-source name in cacti. Please note that this may be a low privileged user. This configuration occurs through http://<HOST>/cacti/data_templates.php by editing an existing or adding a new data template. If a template is linked to a graph then the formatted template name will be rendered in the graph's management page. A user that possesses the General Administration>Sites/Devices/Data permissions can configure the device name in cacti. This vulnerability has been addressed in version 1.2.25. Users are advised to upgrade. Users unable to upgrade should add manual HTML escaping.

Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting (XSS) Vulnerability which allows an authenticated user to poison data stored in the cacti's database. These data will be viewed by administrative cacti accounts and execute JavaScript code in the victim's browser at view-time. The script under graphs.php displays graph details such as data-source paths, data template information and graph related fields. CENSUS found that an adversary that is able to configure either a data-source template with malicious code appended in the data-source name or a device with a malicious payload injected in the device name, may deploy a stored XSS attack against any user with General Administration>Graphs privileges. A user that possesses the Template Editor>Data Templates permissions can configure the data-source name in cacti. Please note that this may be a low privileged user. This configuration occurs through http://<HOST>/cacti/data_templates.php by editing an existing or adding a new data template. If a template is linked to a graph then the formatted template name will be rendered in the graph's management page. A user that possesses the General Administration>Sites/Devices/Data permissions can configure the device name in cacti. This vulnerability has been addressed in version 1.2.25. Users are advised to upgrade. Users unable to upgrade should add manual HTML escaping.

This update for cacti, cacti-spine fixes the following issues:

cacti-spine 1.2.25:

• Spine should see if script to be executed is executable
• Enhance number recognition
• When polling devices, sort by larger number of items first
• Log format may be corrupted when timeout occurs
• Compile warning appears due to GCC flag on RHEL7/RHEL8
• Downed device detection only checks one of the two uptime OIDs
• Compile error appears due to execinfo.h on FreeBSD
• Bootstrap shell script contains some PHP cruft
• Padding is not always removed from the start of non-numeric strings
• Improve SNMP result handling for non-numeric results
• Further improve SNMP result handling for non-numeric results
• Remove check for the max_oids column which has been present since Cacti v1.0
• Minimize Sorting when fetching poller records for maximum performance
• Spine should see if script to be executed is executable

cacti-spine 1.2.24:

• Fix segfault when ignoring older OIDs

cacti 1.2.25:

• CVE-2023-30534: Protect against Insecure deserialization of filter data (boo#1215082)
• CVE-2023-39360: Cross-Site Scripting vulnerability when creating new graphs (boo#1215044)
• CVE-2023-39361: Unauthenticated SQL Injection when viewing graphs (boo#1215045)
• CVE-2023-39357: SQL Injection when saving data with sql_save() (boo#1215040)
• CVE-2023-39362: Authenticated command injection when using SNMP options (boo#1215047)
• CVE-2023-39359: Authenticated SQL injection vulnerability when managing graphs (boo#1215043)
• CVE-2023-39358: Authenticated SQL injection vulnerability when managing reports (boo#1215042)
• CVE-2023-39365: SQL Injection when using regular expressions (boo#1215051)
• CVE-2023-39364: redirect in change password functionality (boo#1215050)
• CVE-2023-39366: Cross-Site Scripting vulnerability with Device Name when managing Data Sources (boo#1215052)
• CVE-2023-39510: Cross-Site Scripting vulnerability with Device Name when administrating Reports (boo#1215053)
• CVE-2023-39511: Cross-Site Scripting vulnerability with Device Name when editing Graphs whilst managing Reports (boo#1215081)
• CVE-2023-39512: Cross-Site Scripting vulnerability with Device Name when managing Data Sources (boo#1215054)
• CVE-2023-39513: Cross-Site Scripting vulnerability with Device Name when debugging data queries (boo#1215055)
• CVE-2023-39514: Cross-Site Scripting vulnerability with Data Source Name when managing Graphs (boo#1215056)
• CVE-2023-39515: Cross-Site Scripting vulnerability with Data Source Name when debugging Data Queries (boo#1215058)
• CVE-2023-39516: Cross-Site Scripting vulnerability with Data Source Information when managing Data Sources (boo#1215059)
• When rebuilding the Poller Cache from command line, allow it to be multi-threaded
• When searching tree or list views, the URL does not update after changes
• When creating a Data Source Template with a specific snmp port, the port is not always applied
• When a Data Query references a file, the filename should be trimmed to remove spurious spaces
• THold plugin may not always install or upgrade properly
• RRD file structures are not always updated properly, if there are more Data Sources in the Data Template than the Graph Template
• When reindexing devices, errors may sometimes be shown
• Boost may loose data when the database server is overloaded
• Boost can sometimes output unexpected or invalid values
• Boost should not attempt to start if there are no items to process
• Rebuilding the poller cache does not always work as expected
• Host CPU items may not work poll as expected when on a remote data collector where hmib is also enabled
• When creating new graphs, invalid offset errors may be generated
• When importing packages, SQL errors may be generated
• When managing plugins from command line, the --plugin option is not properly handled
• When automating an install of Cacti, error messages can be appear
• When performing automated install of a plugin, warnings can be thrown
• Automation…

These are all security issues fixed in the cacti-1.2.25-2.1 package on the GA media of openSUSE Tumbleweed.