Cross-site scripting in Cacti - CVE-2024-43362
Published: October 7, 2024 / Updated: June 19, 2026
Vulnerability identifier: #VU134954
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2024-43362
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary script in a victim's browser.
The vulnerability exists due to cross-site scripting in the external links functionality when processing the fileurl parameter while creating external links. A remote user can submit a specially crafted fileurl value to execute arbitrary script in a victim's browser.
User interaction is required to view the affected page, and exploitation can occur when the victim opens the main console page or the external link view page.
Affected software
Cacti
How to mitigate CVE-2024-43362
Install security update from vendor's website.
Cacti - update to 1.2.28