CVE-2024-30268

2024-05-1400:00:00

ubuntu.com

cacti

operational monitoring

fault management

cross-site scripting

administrator

vulnerability

fix

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

AI Score

5.8

Confidence

High

EPSS

Percentile

15.5%

JSON

Cacti provides an operational monitoring and fault management framework. A
reflected cross-site scripting vulnerability on the 1.3.x DEV branch allows
attackers to obtain cookies of administrator and other users and fake their
login using obtained cookies. This issue is fixed in commit
a38b9046e9772612fda847b46308f9391a49891e.

OSVersionArchitecturePackageVersionFilename
ubuntu18.04noarchcacti< anyUNKNOWN
ubuntu20.04noarchcacti< anyUNKNOWN
ubuntu22.04noarchcacti< anyUNKNOWN
ubuntu24.04noarchcacti< anyUNKNOWN
ubuntu14.04noarchcacti< anyUNKNOWN
ubuntu16.04noarchcacti< anyUNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	18.04	noarch	cacti	< any	UNKNOWN
ubuntu	20.04	noarch	cacti	< any	UNKNOWN
ubuntu	22.04	noarch	cacti	< any	UNKNOWN
ubuntu	24.04	noarch	cacti	< any	UNKNOWN
ubuntu	14.04	noarch	cacti	< any	UNKNOWN
ubuntu	16.04	noarch	cacti	< any	UNKNOWN