SB20241014114 - Multiple vulnerabilities in Cacti
Published: October 14, 2024 Updated: June 19, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 4 vulnerabilities.
1) Code Injection (CVE-ID: CVE-2024-43363)
CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Clear
The vulnerability allows a remote user to execute arbitrary code on the target system.
The vulnerability exists due to improper input validation when handling a device hostname. A remote privileged user can inject arbitrary PHP code via the hostname and execute arbitrary code on the target system.
2) Cross-site scripting (CVE-ID: CVE-2024-43365)
CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to cross-site scripting in the consolenewsection parameter in links.php and its rendering in index.php when creating and viewing external links. A remote user can submit a specially crafted HTTP POST request to cause a denial of service.
The injected input is stored in the database and later reflected to users, and user interaction is required to view the malicious external link entry.
3) Cross-site scripting (CVE-ID: CVE-2024-43364)
CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to cross-site scripting in the external links functionality when saving an external link with a crafted title parameter. A remote user can send a specially crafted request to cause a denial of service.
User interaction is required for the stored payload to be viewed in the application.
4) Cross-site scripting (CVE-ID: CVE-2024-43362)
CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear
The vulnerability allows a remote user to execute arbitrary script in a victim's browser.
The vulnerability exists due to cross-site scripting in the external links functionality when processing the fileurl parameter while creating external links. A remote user can submit a specially crafted fileurl value to execute arbitrary script in a victim's browser.
User interaction is required to view the affected page, and exploitation can occur when the victim opens the main console page or the external link view page.
Remediation
Install update from vendor's website.