CVE-2023-39366

🗓️ 05 Sep 2023 20:42:12Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 131 Views🌐 WEB

Cacti 1.2.25 Stored XSS Vulnerability in data_sources.ph

Reporter	Title	Published	Views	Family All 75
AlpineLinux	CVE-2023-39366	5 Sep 202320:42	–	alpinelinux
Circl	CVE-2023-39366	6 Sep 202300:17	–	circl
CNNVD	Cacti Cross-Site Scripting Vulnerability	5 Sep 202300:00	–	cnnvd
Cvelist	CVE-2023-39366 Stored Cross-site Scripting in data_sources.php through Device-Name in 'select' input in Cacti	5 Sep 202320:42	–	cvelist
Debian	[SECURITY] [DSA 5550-1] cacti security update	8 Nov 202322:40	–	debian
Debian CVE	CVE-2023-39366	5 Sep 202320:42	–	debiancve
Tenable Nessus	Debian DSA-5550-1 : cacti - security update	9 Nov 202300:00	–	nessus
Tenable Nessus	Fedora 37 : cacti / cacti-spine (2023-06a2a6e03c)	13 Oct 202300:00	–	nessus
Tenable Nessus	Fedora 39 : cacti / cacti-spine (2023-248dff7cbe)	7 Nov 202300:00	–	nessus
Tenable Nessus	Fedora 38 : cacti / cacti-spine (2023-6335ea9c0c)	13 Oct 202300:00	–	nessus

NVD

Vulners

Vulnrichment

Node

cacti cactiRange1.2.0–1.2.25

Node

fedoraproject fedoraMatch37

fedoraproject fedoraMatch38

[
  {
    "vendor": "Cacti",
    "product": "cacti",
    "versions": [
      {
        "version": "< 1.2.25",
        "status": "affected"
      }
    ]
  }
]

Source	Link
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/WZGB2UXJEUYWWA6IWVFQ3ZTP22FIHMGN/
debian	www.debian.org/security/2023/dsa-5550
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/WOQFYGLZBAWT4AWNMO7DU73QXWPXTCKH/
github	www.github.com/Cacti/cacti/security/advisories/GHSA-rwhh-xxm6-vcrv
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/CFH3J2WVBKY4ZJNMARVOWJQK6PSLPHFH/

Parameter	Position	Path	Description	CWE
device_name	request body	/cacti/host.php	Stored XSS via device name configured in host.php.	CWE-79

21 Nov 2024 08:15Current

5.7Medium risk

Vulners AI Score5.7

CVSS 3.14.8 - 6.1

EPSS0.00414

SSVC

CWE-79