CVE-2024-43362

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Cacti is an open source performance and fault management framework. The `fileurl` parameter is not properly sanitized when saving external links in `links.php` . Morever, the said fileurl is placed in some html code which is passed to the `print` function in `link.php` and `index.php`, finally leading to stored XSS. Users with the privilege to create external links can manipulate the `fileurl` parameter in the http post request while creating external links to perform stored XSS attacks. The vulnerability known as XSS (Cross-Site Scripting) occurs when an application allows untrusted user input to be displayed on a web page without proper validation or escaping. This issue has been addressed in release version 1.2.28. All users are advised to upgrade. There are no known workarounds for this issue.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Oct 7, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-433637.2Cacti is an open source performance and fault management framework. An admin user can create a device with a malicious hostname containing p CVE-2024-433648.2Cacti is an open source performance and fault management framework. The `title` parameter is not properly sanitized when saving external lin CVE-2024-433658.2Cacti is an open source performance and fault management framework. The`consolenewsection` parameter is not properly sanitized when saving e CVE-2024-433669.1zkvyper is a Vyper compiler. Starting in version 1.3.12 and prior to version 1.5.3, since LLL IR has no Turing-incompletness restrictions, i CVE-2024-433677.5Boa is an embeddable and experimental Javascript engine written in Rust. Starting in version 0.16 and prior to version 0.19.0, a wrong assum CVE-2024-433686.5The Trix editor, versions prior to 2.1.4, is vulnerable to XSS when pasting malicious code. This vulnerability is a bypass of the fix put in CVE-2024-433697.2Ibexa RichText Field Type is a Field Type for supporting rich formatted text stored in a structured XML format. In versions on the 4.6 branc CVE-2024-43377.4Adive Framework 2.0.8, does not sufficiently encode user-controlled inputs, resulting in a persistent Cross-Site Scripting (XSS) vulnerabili CVE-2024-433707.2gettext.js is a GNU gettext port for node and the browser. There is a cross-site scripting (XSS) injection if `.po` dictionary definition fi CVE-2024-433716.5CKAN is an open-source data management system for powering data hubs and data portals. There are a number of CKAN plugins, including XLoader CVE-2024-433737.8webcrack is a tool for reverse engineering javascript. An arbitrary file write vulnerability exists in the webcrack module when processing s CVE-2024-433744.7The UNIX editor Vim prior to version 9.1.0678 has a use-after-free error in argument list handling. When adding a new file to the argument l