CVE-2023-50569

2023-12-2211:15:07

Google

osv.dev

cve-2023-50569

reflected cross site scripting

cacti v1.2.25

privilege escalation

template upload

software

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

30.2%

JSON

Reflected Cross Site Scripting (XSS) vulnerability in Cacti v1.2.25, allows remote attackers to escalate privileges when uploading an xml template file via templates_import.php.

CPENameOperatorVersion
cactieqrelease/1.1.33
cactieqrelease/1.2.0-beta2
cactieqrelease/1.2.7
cactieqrelease/1.1.19
cactieqrelease/1.2.13
cactieqrelease/1.1.34
cactieqrelease/1.1.4
cactieqrelease/1.2.21
cactieqrelease/1.1.20
cactieqrelease/1.1.15

Name	Operator	Version
cacti	eq	release/1.1.33
cacti	eq	release/1.2.0-beta2
cacti	eq	release/1.2.7
cacti	eq	release/1.1.19
cacti	eq	release/1.2.13
cacti	eq	release/1.1.34
cacti	eq	release/1.1.4
cacti	eq	release/1.2.21
cacti	eq	release/1.1.20
cacti	eq	release/1.1.15