Skip to content
Fencer Vulns
medium 5.7

CVE-2024-43364 json

Stored Cross-site Scripting (XSS) when creating external links in Cacti

published 2024-10-07 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-40252

cvss
5.7
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
37.9%
EPSS 37.9% chance of exploitation in 30 days, percentile 98%
public exploits
0
none known

Summary

Cacti is an open source performance and fault management framework. The `title` parameter is not properly sanitized when saving external links in links.php . Morever, the said title parameter is stored in the database and reflected back to user in index.php, finally leading to stored XSS. Users with the privilege to create external links can manipulate the `title` parameter in the http post request while creating external links to perform stored XSS attacks. The vulnerability known as XSS (Cross-Site Scripting) occurs when an application allows untrusted user input to be displayed on a web page without proper validation or escaping. This issue has been addressed in release version 1.2.28. All users are advised to upgrade. There are no known workarounds for this vulnerability.

Patch / fix

  • Cacti cacti 1.2.28
  • cacti Debian 12 1.2.24+ds1-1+deb12u5
  • cacti Debian 14, Debian 13 1.2.28+ds1-1

debian advisories DEBIAN-CVE-2024-43364

  • cacti Alpine 3.24, Alpine 3.23, Alpine 3.22 +2 more 1.2.28-r0
  • cacti Alpine 3.24, Alpine 3.23, Alpine 3.22 +1 more 1.2.29-r0

alpine advisories ALPINE-CVE-2024-43364

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-43364 updated cvss 8.2

cacti: Stored Cross-site Scripting (XSS) when creating external links in Cacti

  • Red Hat All currently supported Red Hat products
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
partial
Assessed
2 y ago

Exploit prediction

37.88% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/Cacti/cacti/security/advisories/GHSA-fgc6-g8gc-wcg5 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 5.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
NVD 3.1 8.2 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:H

Affected products

  • Cacti cacti

Classification

Weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.