Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting (XSS) Vulnerability allows an authenticated user to poison data stored in the _cacti_'s database. These data will be viewed by administrative _cacti_ accounts and execute JavaScript code in the victim's browser at view-time. The `data_sources.php` script displays the data source management information (e.g. data source path, polling configuration etc.) for different data visualizations of the _cacti_ app. CENSUS found that an adversary that is able to configure a malicious Device name, can deploy a stored XSS attack against any user of the same (or broader) privileges. A user that possesses the _General Administration>Sites/Devices/Data_ permissions can configure the device names in _cacti_. This configuration occurs through `http://<HOST>/cacti/host.php`, while the rendered malicious payload is exhibited at `http://<HOST>/cacti/data_sources.php`. This vulnerability has been addressed in version 1.2.25. Users are advised to upgrade. Users unable to update should manually filter HTML output.

• https://github.com/Cacti/cacti/security/advisories/GHSA-rwhh-xxm6-vcrv
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CFH3J2WVBKY4ZJNMARVOWJQK6PSLPHFH/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WOQFYGLZBAWT4AWNMO7DU73QXWPXTCKH/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WZGB2UXJEUYWWA6IWVFQ3ZTP22FIHMGN/
• https://www.debian.org/security/2023/dsa-5550
• https://github.com/Cacti/cacti/security/advisories/GHSA-rwhh-xxm6-vcrv
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CFH3J2WVBKY4ZJNMARVOWJQK6PSLPHFH/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WOQFYGLZBAWT4AWNMO7DU73QXWPXTCKH/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WZGB2UXJEUYWWA6IWVFQ3ZTP22FIHMGN/
• https://www.debian.org/security/2023/dsa-5550

• Cacti » Cacti » Version: 1.2.0
  cpe:2.3:a:cacti:cacti:1.2.0
• Cacti » Cacti » Version: 1.2.1
  cpe:2.3:a:cacti:cacti:1.2.1
• Cacti » Cacti » Version: 1.2.10
  cpe:2.3:a:cacti:cacti:1.2.10
• Cacti » Cacti » Version: 1.2.11
  cpe:2.3:a:cacti:cacti:1.2.11
• Cacti » Cacti » Version: 1.2.12
  cpe:2.3:a:cacti:cacti:1.2.12
• Cacti » Cacti » Version: 1.2.13
  cpe:2.3:a:cacti:cacti:1.2.13
• Cacti » Cacti » Version: 1.2.14
  cpe:2.3:a:cacti:cacti:1.2.14
• Cacti » Cacti » Version: 1.2.15
  cpe:2.3:a:cacti:cacti:1.2.15
• Cacti » Cacti » Version: 1.2.16
  cpe:2.3:a:cacti:cacti:1.2.16
• Cacti » Cacti » Version: 1.2.17
  cpe:2.3:a:cacti:cacti:1.2.17
• Cacti » Cacti » Version: 1.2.18
  cpe:2.3:a:cacti:cacti:1.2.18
• Cacti » Cacti » Version: 1.2.19
  cpe:2.3:a:cacti:cacti:1.2.19
• Cacti » Cacti » Version: 1.2.2
  cpe:2.3:a:cacti:cacti:1.2.2
• Cacti » Cacti » Version: 1.2.20
  cpe:2.3:a:cacti:cacti:1.2.20
• Cacti » Cacti » Version: 1.2.21
  cpe:2.3:a:cacti:cacti:1.2.21
• Cacti » Cacti » Version: 1.2.22
  cpe:2.3:a:cacti:cacti:1.2.22
• Cacti » Cacti » Version: 1.2.23
  cpe:2.3:a:cacti:cacti:1.2.23
• Cacti » Cacti » Version: 1.2.24
  cpe:2.3:a:cacti:cacti:1.2.24
• Cacti » Cacti » Version: 1.2.3
  cpe:2.3:a:cacti:cacti:1.2.3
• Cacti » Cacti » Version: 1.2.4
  cpe:2.3:a:cacti:cacti:1.2.4
• Cacti » Cacti » Version: 1.2.5
  cpe:2.3:a:cacti:cacti:1.2.5
• Cacti » Cacti » Version: 1.2.6
  cpe:2.3:a:cacti:cacti:1.2.6
• Cacti » Cacti » Version: 1.2.7
  cpe:2.3:a:cacti:cacti:1.2.7
• Cacti » Cacti » Version: 1.2.8
  cpe:2.3:a:cacti:cacti:1.2.8
• Cacti » Cacti » Version: 1.2.9
  cpe:2.3:a:cacti:cacti:1.2.9
• Fedoraproject » Fedora » Version: 37
  cpe:2.3:o:fedoraproject:fedora:37
• Fedoraproject » Fedora » Version: 38
  cpe:2.3:o:fedoraproject:fedora:38