{"id":"CVE-2023-39366","aliases":["ALPINE-CVE-2023-39366","DEBIAN-CVE-2023-39366","EUVD-2023-43091","GHSA-rwhh-xxm6-vcrv","UBUNTU-CVE-2023-39366","openSUSE-SU-2023:0275-1","openSUSE-SU-2024:13203-1"],"status":"published","title":"Stored Cross-site Scripting in data_sources.php through Device-Name in 'select' input in Cacti","description":"Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting (XSS) Vulnerability allows an authenticated user to poison data stored in the _cacti_'s database. These data will be viewed by administrative _cacti_ accounts and execute JavaScript code in the victim's browser at view-time. The `data_sources.php` script displays the data source management information (e.g. data source path, polling configuration etc.) for different data visualizations of the _cacti_ app. \nCENSUS found that an adversary that is able to configure a malicious Device name, can deploy a stored XSS attack against any user of the same (or broader) privileges. A user that possesses the _General Administration\u003eSites/Devices/Data_ permissions can configure the device names in _cacti_. This configuration occurs through `http://\u003cHOST\u003e/cacti/host.php`, while the rendered malicious payload is exhibited at `http://\u003cHOST\u003e/cacti/data_sources.php`. This vulnerability has been addressed in version 1.2.25. Users are advised to upgrade. Users unable to update should manually filter HTML output.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00889,"percentile":0.59599,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2023-09-05T20:42:12Z","modified":"2026-11-03T06:32:48Z","fixes":[{"ecosystem":"Alpine:v3.18","package":"cacti","fixed_in":["1.2.26-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"cacti","fixed_in":["1.2.25-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"cacti","fixed_in":["1.2.25-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"cacti","fixed_in":["1.2.25-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"cacti","fixed_in":["1.2.25-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"cacti","fixed_in":["1.2.25-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"cacti","fixed_in":["1.2.25-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"cacti","fixed_in":["1.2.24+ds1-1+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"cacti","fixed_in":["1.2.25+ds1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"cacti","fixed_in":["1.2.25+ds1-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.18","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.0"},{"fixed":"1.2.26-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.0"},{"fixed":"1.2.25-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.0"},{"fixed":"1.2.25-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.0"},{"fixed":"1.2.25-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.0"},{"fixed":"1.2.25-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.0"},{"fixed":"1.2.25-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.0"},{"fixed":"1.2.25-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.24+ds1-1+deb12u1"}]}],"versions":["1.2.24+ds1-1"]},{"source":"osv","ecosystem":"Debian:13","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.25+ds1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.25+ds1-1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.8.8b+dfsg-3","0.8.8b+dfsg-5","0.8.8b+dfsg-5ubuntu0.1","0.8.8b+dfsg-5ubuntu0.2","0.8.8b+dfsg-5ubuntu0.2+esm1","0.8.8b+dfsg-5ubuntu0.2+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.8.8f+ds1-2","0.8.8f+ds1-3","0.8.8f+ds1-4","0.8.8f+ds1-4ubuntu1","0.8.8f+ds1-4ubuntu2","0.8.8f+ds1-4ubuntu3","0.8.8f+ds1-4ubuntu4","0.8.8f+ds1-4ubuntu4.16.04","0.8.8f+ds1-4ubuntu4.16.04.1","0.8.8f+ds1-4ubuntu4.16.04.2","0.8.8f+ds1-4ubuntu4.16.04.2+esm1","0.8.8f+ds1-4ubuntu4.16.04.2+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.18+ds1-1","1.1.27+ds1-2","1.1.27+ds1-3","1.1.28+ds1-2","1.1.35+ds1-1","1.1.36+ds1-1","1.1.38+ds1-1","1.1.38+ds1-1ubuntu0.1~esm1","1.1.38+ds1-1ubuntu0.1~esm3","1.1.38+ds1-1ubuntu0.1~esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.4+ds1-2ubuntu3","1.2.9+ds1-1ubuntu1","1.2.9+ds1-1ubuntu2","1.2.10+ds1-1ubuntu1","1.2.10+ds1-1ubuntu1+esm1","1.2.10+ds1-1ubuntu1.1","1.2.10+ds1-1ubuntu1.1+esm1","1.2.10+ds1-1ubuntu1.1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.16+ds1-2ubuntu1","1.2.19+ds1-2ubuntu1","1.2.19+ds1-2ubuntu1+esm1","1.2.19+ds1-2ubuntu1.1","1.2.19+ds1-2ubuntu1.1+esm1","1.2.19+ds1-2ubuntu1.1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.25+ds1-2","1.2.26+ds1-1","1.2.26+ds1-1ubuntu0.1"]},{"source":"osv","ecosystem":"SUSE:Package Hub 12","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.25-bp155.2.3.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Package Hub 12","package":"cacti-spine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.25-bp155.2.3.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP4","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.25-bp155.2.3.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP4","package":"cacti-spine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.25-bp155.2.3.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP5","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.25-bp155.2.3.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP5","package":"cacti-spine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.25-bp155.2.3.1"}]}],"bundled":17},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.25-bp155.2.3.1"}]}],"bundled":17},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"cacti-spine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.25-bp155.2.3.1"}]}],"bundled":17},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.25-bp155.2.3.1"}]}],"bundled":17},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"cacti-spine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.25-bp155.2.3.1"}]}],"bundled":17},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.25-2.1"}]}],"bundled":17}],"products":[{"vendor":"cacti","product":"cacti"},{"vendor":"fedoraproject","product":"fedora"}],"references":[{"url":"https://github.com/Cacti/cacti/security/advisories/GHSA-rwhh-xxm6-vcrv","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Vendor Advisory","advisory","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WZGB2UXJEUYWWA6IWVFQ3ZTP22FIHMGN/","tags":["x_transferred","Mailing List","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CFH3J2WVBKY4ZJNMARVOWJQK6PSLPHFH/","tags":["x_transferred","Mailing List","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WOQFYGLZBAWT4AWNMO7DU73QXWPXTCKH/","tags":["x_transferred","web"]},{"url":"https://www.debian.org/security/2023/dsa-5550","tags":["x_transferred","advisory"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2023-39366","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/39xxx/CVE-2023-39366.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-39366","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-39366","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-39366","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-39366","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/JFJCU2NOOFCO7XJZOUW2BQ6HWJMHSYSN/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1215040","tags":["report"]},{"url":"https://bugzilla.suse.com/1215042","tags":["report"]},{"url":"https://bugzilla.suse.com/1215043","tags":["report"]},{"url":"https://bugzilla.suse.com/1215044","tags":["report"]},{"url":"https://bugzilla.suse.com/1215045","tags":["report"]},{"url":"https://bugzilla.suse.com/1215047","tags":["report"]},{"url":"https://bugzilla.suse.com/1215050","tags":["report"]},{"url":"https://bugzilla.suse.com/1215051","tags":["report"]},{"url":"https://bugzilla.suse.com/1215052","tags":["report"]},{"url":"https://bugzilla.suse.com/1215053","tags":["report"]},{"url":"https://bugzilla.suse.com/1215054","tags":["report"]},{"url":"https://bugzilla.suse.com/1215055","tags":["report"]},{"url":"https://bugzilla.suse.com/1215056","tags":["report"]},{"url":"https://bugzilla.suse.com/1215058","tags":["report"]},{"url":"https://bugzilla.suse.com/1215059","tags":["report"]},{"url":"https://bugzilla.suse.com/1215081","tags":["report"]},{"url":"https://bugzilla.suse.com/1215082","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-30534","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-39357","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-39358","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-39359","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-39360","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-39361","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-39362","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-39364","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-39365","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-39366","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-39510","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-39511","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-39512","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-39513","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-39514","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-39515","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-39516","tags":["web"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-39366","title":"Stored Cross-site Scripting in data_sources.php through Device-Name in 'select' input in Cacti","description":"Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting (XSS) Vulnerability allows an authenticated user to poison data stored in the _cacti_'s database. These data will be viewed by administrative _cacti_ accounts and execute JavaScript code in the victim's browser at view-time. The `data_sources.php` script displays the data source management information (e.g. data source path, polling configuration etc.) for different data visualizations of the _cacti_ app. \nCENSUS found that an adversary that is able to configure a malicious Device name, can deploy a stored XSS attack against any user of the same (or broader) privileges. A user that possesses the _General Administration\u003eSites/Devices/Data_ permissions can configure the device names in _cacti_. This configuration occurs through `http://\u003cHOST\u003e/cacti/host.php`, while the rendered malicious payload is exhibited at `http://\u003cHOST\u003e/cacti/data_sources.php`. This vulnerability has been addressed in version 1.2.25. Users are advised to upgrade. Users unable to update should manually filter HTML output.","status":"published","published":"2023-09-05T20:42:12.716Z","modified":"2025-02-13T17:03:01.901Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:35:33.462059Z"}],"euvd":[{"id":"EUVD-2023-43091","description":"Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting (XSS) Vulnerability allows an authenticated user to poison data stored in the _cacti_'s database. These data will be viewed by administrative _cacti_ accounts and execute JavaScript code in the victim's browser at view-time. The `data_sources.php` script displays the data source management information (e.g. data source path, polling configuration etc.) for different data visualizations of the _cacti_ app. \nCENSUS found that an adversary that is able to configure a malicious Device name, can deploy a stored XSS attack against any user of the same (or broader) privileges. A user that possesses the _General Administration\u003eSites/Devices/Data_ permissions can configure the device names in _cacti_. This configuration occurs through `http://\u003cHOST\u003e/cacti/host.php`, while the rendered malicious payload is exhibited at `http://\u003cHOST\u003e/cacti/data_sources.php`. This vulnerability has been addressed in version 1.2.25. Users are advised to upgrade. Users unable to update should manually filter HTML output.","status":"published","published":"2023-09-05T20:42:12Z","modified":"2025-02-13T17:03:01Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N","level":"medium"}],"updated_at":"2026-11-03T00:03:49.604577Z"}],"nvd":[{"id":"CVE-2023-39366","description":"Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting (XSS) Vulnerability allows an authenticated user to poison data stored in the _cacti_'s database. These data will be viewed by administrative _cacti_ accounts and execute JavaScript code in the victim's browser at view-time. The `data_sources.php` script displays the data source management information (e.g. data source path, polling configuration etc.) for different data visualizations of the _cacti_ app. \nCENSUS found that an adversary that is able to configure a malicious Device name, can deploy a stored XSS attack against any user of the same (or broader) privileges. A user that possesses the _General Administration\u003eSites/Devices/Data_ permissions can configure the device names in _cacti_. This configuration occurs through `http://\u003cHOST\u003e/cacti/host.php`, while the rendered malicious payload is exhibited at `http://\u003cHOST\u003e/cacti/data_sources.php`. This vulnerability has been addressed in version 1.2.25. Users are advised to upgrade. Users unable to update should manually filter HTML output.","status":"published","published":"2023-09-05T21:15:46.963Z","modified":"2026-06-17T06:12:09.287Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:08:27.181588Z"}],"osv":[{"id":"ALPINE-CVE-2023-39366","description":"Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting (XSS) Vulnerability allows an authenticated user to poison data stored in the _cacti_'s database. These data will be viewed by administrative _cacti_ accounts and execute JavaScript code in the victim's browser at view-time. The `data_sources.php` script displays the data source management information (e.g. data source path, polling configuration etc.) for different data visualizations of the _cacti_ app. \nCENSUS found that an adversary that is able to configure a malicious Device name, can deploy a stored XSS attack against any user of the same (or broader) privileges. A user that possesses the _General Administration\u003eSites/Devices/Data_ permissions can configure the device names in _cacti_. This configuration occurs through `http://\u003cHOST\u003e/cacti/host.php`, while the rendered malicious payload is exhibited at `http://\u003cHOST\u003e/cacti/data_sources.php`. This vulnerability has been addressed in version 1.2.25. Users are advised to upgrade. Users unable to update should manually filter HTML output.","status":"published","published":"2023-09-05T21:15:46.963Z","modified":"2026-11-03T06:32:48.902637802Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T07:16:46.202932Z"},{"id":"CVE-2023-39366","title":"Stored Cross-site Scripting in data_sources.php through Device-Name in 'select' input in Cacti","description":"Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting (XSS) Vulnerability allows an authenticated user to poison data stored in the _cacti_'s database. These data will be viewed by administrative _cacti_ accounts and execute JavaScript code in the victim's browser at view-time. The `data_sources.php` script displays the data source management information (e.g. data source path, polling configuration etc.) for different data visualizations of the _cacti_ app. \nCENSUS found that an adversary that is able to configure a malicious Device name, can deploy a stored XSS attack against any user of the same (or broader) privileges. A user that possesses the _General Administration\u003eSites/Devices/Data_ permissions can configure the device names in _cacti_. This configuration occurs through `http://\u003cHOST\u003e/cacti/host.php`, while the rendered malicious payload is exhibited at `http://\u003cHOST\u003e/cacti/data_sources.php`. This vulnerability has been addressed in version 1.2.25. Users are advised to upgrade. Users unable to update should manually filter HTML output.","status":"published","published":"2023-09-05T20:42:12.716Z","modified":"2026-10-28T02:30:33.807620054Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:44:32.922049Z"},{"id":"DEBIAN-CVE-2023-39366","description":"Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting (XSS) Vulnerability allows an authenticated user to poison data stored in the _cacti_'s database. These data will be viewed by administrative _cacti_ accounts and execute JavaScript code in the victim's browser at view-time. The `data_sources.php` script displays the data source management information (e.g. data source path, polling configuration etc.) for different data visualizations of the _cacti_ app.  CENSUS found that an adversary that is able to configure a malicious Device name, can deploy a stored XSS attack against any user of the same (or broader) privileges. A user that possesses the _General Administration\u003eSites/Devices/Data_ permissions can configure the device names in _cacti_. This configuration occurs through `http://\u003cHOST\u003e/cacti/host.php`, while the rendered malicious payload is exhibited at `http://\u003cHOST\u003e/cacti/data_sources.php`. This vulnerability has been addressed in version 1.2.25. Users are advised to upgrade. Users unable to update should manually filter HTML output.","status":"published","published":"2023-09-05T21:15:46.963Z","modified":"2026-10-26T18:01:52.295439479Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:39.980321Z"},{"id":"UBUNTU-CVE-2023-39366","description":"Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting (XSS) Vulnerability allows an authenticated user to poison data stored in the _cacti_'s database. These data will be viewed by administrative _cacti_ accounts and execute JavaScript code in the victim's browser at view-time. The `data_sources.php` script displays the data source management information (e.g. data source path, polling configuration etc.) for different data visualizations of the _cacti_ app. CENSUS found that an adversary that is able to configure a malicious Device name, can deploy a stored XSS attack against any user of the same (or broader) privileges. A user that possesses the _General Administration\u003eSites/Devices/Data_ permissions can configure the device names in _cacti_. This configuration occurs through `http://\u003cHOST\u003e/cacti/host.php`, while the rendered malicious payload is exhibited at `http://\u003cHOST\u003e/cacti/data_sources.php`. This vulnerability has been addressed in version 1.2.25. Users are advised to upgrade. Users unable to update should manually filter HTML output.","status":"published","published":"2023-09-05T21:15:00Z","modified":"2025-10-24T05:02:13Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N","level":"medium"},{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:54:21.882004Z"},{"id":"openSUSE-SU-2023:0275-1","title":"Security update for cacti, cacti-spine","description":"This update for cacti, cacti-spine fixes the following issues:\n\ncacti-spine 1.2.25:\n\n* Spine should see if script to be executed is executable\n* Enhance number recognition\n* When polling devices, sort by larger number of items first\n* Log format may be corrupted when timeout occurs\n* Compile warning appears due to GCC flag on RHEL7/RHEL8\n* Downed device detection only checks one of the two uptime OIDs\n* Compile error appears due to execinfo.h on FreeBSD\n* Bootstrap shell script contains some PHP cruft\n* Padding is not always removed from the start of non-numeric strings\n* Improve SNMP result handling for non-numeric results\n* Further improve SNMP result handling for non-numeric results\n* Remove check for the max_oids column which has been present since Cacti v1.0\n* Minimize Sorting when fetching poller records for maximum performance\n* Spine should see if script to be executed is executable\n\ncacti-spine 1.2.24:\n\n* Fix segfault when ignoring older OIDs\n\ncacti 1.2.25:\n\n* CVE-2023-30534: Protect against Insecure deserialization of filter data (boo#1215082)\n* CVE-2023-39360: Cross-Site Scripting vulnerability when creating new graphs (boo#1215044)\n* CVE-2023-39361: Unauthenticated SQL Injection when viewing graphs (boo#1215045)\n* CVE-2023-39357: SQL Injection when saving data with sql_save() (boo#1215040)\n* CVE-2023-39362: Authenticated command injection when using SNMP options (boo#1215047)\n* CVE-2023-39359: Authenticated SQL injection vulnerability when managing graphs (boo#1215043)\n* CVE-2023-39358: Authenticated SQL injection vulnerability when managing reports (boo#1215042)\n* CVE-2023-39365: SQL Injection when using regular expressions (boo#1215051)\n* CVE-2023-39364: redirect in change password functionality (boo#1215050)\n* CVE-2023-39366: Cross-Site Scripting vulnerability with Device Name when managing Data Sources (boo#1215052)\n* CVE-2023-39510: Cross-Site Scripting vulnerability with Device Name when administrating Reports (boo#1215053)\n* CVE-2023-39511: Cross-Site Scripting vulnerability with Device Name when editing Graphs whilst managing Reports (boo#1215081)\n* CVE-2023-39512: Cross-Site Scripting vulnerability with Device Name when managing Data Sources (boo#1215054)\n* CVE-2023-39513: Cross-Site Scripting vulnerability with Device Name when debugging data queries (boo#1215055)\n* CVE-2023-39514: Cross-Site Scripting vulnerability with Data Source Name when managing Graphs (boo#1215056)\n* CVE-2023-39515: Cross-Site Scripting vulnerability with Data Source Name when debugging Data Queries (boo#1215058)\n* CVE-2023-39516: Cross-Site Scripting vulnerability with Data Source Information when managing Data Sources (boo#1215059)\n* When rebuilding the Poller Cache from command line, allow it to be multi-threaded\n* When searching tree or list views, the URL does not update after changes\n* When creating a Data Source Template with a specific snmp port, the port is not always applied\n* When a Data Query references a file, the filename should be trimmed to remove spurious spaces\n* THold plugin may not always install or upgrade properly\n* RRD file structures are not always updated properly, if there are more Data Sources in the Data Template than the Graph Template\n* When reindexing devices, errors may sometimes be shown\n* Boost may loose data when the database server is overloaded\n* Boost can sometimes output unexpected or invalid values\n* Boost should not attempt to start if there are no items to process\n* Rebuilding the poller cache does not always work as expected\n* Host CPU items may not work poll as expected when on a remote data collector where hmib is also enabled\n* When creating new graphs, invalid offset errors may be generated\n* When importing packages, SQL errors may be generated\n* When managing plugins from command line, the --plugin option is not properly handled\n* When automating an install of Cacti, error messages can be appear\n* When performing automated install of a plugin, warnings can be thrown\n* Automation references the wrong table name causing errors\n* Data Source Info Mode produces invalid recommendations\n* Data Source Debug 'Run All' generates too many log messages\n* The description of rebuild poller cache in utilities does not display properly\n* When reindexing a device, debug information may not always display properly\n* Upon displaying a form with errors, the session error fields variable isn't cleared\n* MariaDB clusters will no longer support exclusive locks\n* RRDtool can fail to update when sources in Data Template and Graph Template data sources do not match\n* Compatibility improvements for Boost under PHP 8.x\n* When searching the tree, increase the time before querying for items\n* Device Location drop down does not always populate correctly\n* When viewing Realtime graphs, undefined variable errors may be reported\n* SNMP Uptime is not always ignored for spikekills\n* Improve detection of downed Devices\n* When reporting missing functions from Plugins, ensure messages do not occur too often\n* When starting the Cacti daemon, database errors may be reported when there is no problem\n* When reporting from RRDcheck, ensure prefix is in the correct casing\n* Improve Orphaned Data Source options and display\n* Parsing the PHP Configuration may sometimes produce errors\n* Security processes attempt to check for a user lockout even if there is no user logged in\n* When attempting to edit a tree, the search filter for Graphs remains disabled\n* When reindexing, a Data Source that could be un-orphaned may not always be unorphaned\n* When parsing a date value, there could be more than 30 chars\n* Untemplated Data Sources can fail to update due to lack of an assigned Graph\n* When processing items to check, do not include disabled hosts\n* When saving a Data Source Template, SQL errors may be reported\n* When importing a Template, errors may be recorded\n* Some display strings have invalid formatting that cannot be parsed\n* When filtering with regular expressions, the 'does not match' option does not always function as expected\n* When enabling a plugin, sometimes it can appear as if nothing happens\n* Ensure the Rows Per Page option shows limitations set by configuration\n* Plugins are unable to modify fields in the setting 'Change Device Settings'\n* When reporting emails being sent, ensure BCC addresses are also included\n* Improve compatibility of SNMP class trim handling under PHP 8.x\n* When importing legacy Data Query Templates, the Template can become unusable\n* Provide ability to raise an event when extending the settings form\n* Prevent unsupported SQL Mode flags from being set\n* The DSStats summary does not always display expected values\n* When performing a fresh install, device classification may be missing.\n* Duplication functions for Graph/Template and Data Source/Template do not return and id\n* Duplication of Device Templates should be an API call\n* Unable to convert database to latin1 instead of utf8 if desired\n* When creating Graphs, the process may become slower over time as more items exist\n* When a bulk walk size is set to automatic, this is not always set to the optimal value\n* Update copyright notice on import packages\n* When viewing Orphan Graphs, SQL errors may be reported\n* When reindexing hosts from command line, ensure only one process runs at once\n* When a Data Query has no Graphs, it may not be deletable\n* When duplicating a Graph Template, provide an option to not duplicate Data Query association\n* When duplicating a Data Template errors can appear in the Cacti log\n* When importing a Package, previewing makes unexpected changes to Cacti Templates\n* When enabling boost on a fresh install, an error may be reported\n* Improve compatibility for backtrace logging under PHP 8.x\n* Improve compatibility for Advanced Ping under PHP 8.x\n* Provide new templates for Fortigate and Aruba Cluster to be available during install\n* Provide new template for SNMP Printer to be available during install\n* When importing devices, allow a device classification to be known\n* Extend length of maximum name in settings table\n* Extend length of maximum name in user settings table\n* Data Queries do not have a Duplication function\n* Upgrade d3.js v7.8.2 and billboard.js v3.7.4\n* Upgrade ua-parser.js to version 1.0.35\n* Update Cisco Device Template to include HSRP graph template\n* New hook for device template change 'device_template_change'\n\ncacti 1.2.24\n\n* Fix: Unable to import Local Linux Machine template\n* Fix multiple charting and display issues\n* Compatibility changes for SNMP under PHP 8.2, and other PHP\n  compatibility updates\n* Fix multiple issues editing settings\n* timeout fixes for Basic Auth\n* multiple data poller bug fixes\n","status":"published","published":"2023-09-26T13:31:33Z","modified":"2026-02-04T02:59:17.01138Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2024:13203-1","title":"cacti-1.2.25-2.1 on GA media","description":"These are all security issues fixed in the cacti-1.2.25-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:29:27.312962Z","updated_at":"2026-11-02T16:58:36.025801Z"}]}}