CVE-2024-43365
Published: 07 October 2024
Summary
CVE-2024-43365 is a medium-severity Cross-site Scripting (CWE-79) vulnerability in Cacti Cacti. Its CVSS base score is 5.7 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked in the top 9.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
Cacti, an open source performance and fault management framework, contains a stored cross-site scripting vulnerability tracked as CVE-2024-43365. The consolenewsection parameter is insufficiently sanitized when external links are saved via links.php; the value is persisted in the database and later reflected without escaping on index.php, enabling persistent XSS under CWE-79.
An authenticated user holding the privilege to create external links can supply a crafted consolenewsection value in the HTTP POST request. Successful exploitation results in arbitrary script execution in the context of other users who view the affected page, producing a CVSS 5.7 impact focused on availability.
The issue is resolved in Cacti 1.2.28; administrators are advised to upgrade, as no workarounds exist. The associated GitHub Security Advisory GHSA-49f2-hwx9-qffr and the Debian LTS announcement provide further details on the patch.
EPSS remains flat at 0.0543 with no material increase after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-40253
Vulnerability details
Cacti is an open source performance and fault management framework. The`consolenewsection` parameter is not properly sanitized when saving external links in links.php . Morever, the said consolenewsection parameter is stored in the database and reflected back to user in `index.php`,…
more
finally leading to stored XSS. Users with the privilege to create external links can manipulate the “consolenewsection” parameter in the http post request while creating external links to perform stored XSS attacks. The vulnerability known as XSS (Cross-Site Scripting) occurs when an application allows untrusted user input to be displayed on a web page without proper validation or escaping. This issue has been addressed in release version 1.2.28. All users are advised to upgrade. There are no known workarounds for this vulnerability.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stored XSS enables JavaScript execution in victim browsers via exploitation (T1203, T1059.007) and facilitates application denial of service through malicious payloads (T1499.004).
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Penetration testing submits XSS payloads to web applications, detecting cross-site scripting flaws for subsequent remediation.
Validates web inputs to reject script-related content that could produce XSS.
Output validation against expected content can reject or sanitize script content in generated web pages, reducing XSS exploitability.