CVE-2023-39513

Cacti is an open source operational monitoring and fault management
framework. Affected versions are subject to a Stored Cross-Site-Scripting
(XSS) Vulnerability which allows an authenticated user to poison data
stored in the cacti’s database. These data will be viewed by
administrative cacti accounts and execute JavaScript code in the victim’s
browser at view-time. The script under host.php is used to monitor and
manage hosts in the cacti app, hence displays useful information such as
data queries and verbose logs. CENSUS found that an adversary that is
able to configure a data-query template with malicious code appended in the
template path, in order to deploy a stored XSS attack against any user with
the General Administration>Sites/Devices/Data privileges. A user that
possesses the Template Editor>Data Queries permissions can configure the
data query template path in cacti. Please note that such a user may be a
low privileged user. This configuration occurs through
http://<HOST>/cacti/data_queries.php by editing an existing or adding a
new data query template. If a template is linked to a device then the
formatted template path will be rendered in the device’s management page,
when a verbose data query is requested. This vulnerability has been
addressed in version 1.2.25. Users are advised to upgrade. Users unable to
update should manually filter HTML output.