CVE-2024-43363

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

Cacti is an open source performance and fault management framework. An admin user can create a device with a malicious hostname containing php code and repeat the installation process (completing only step 5 of the installation process is enough, no need to complete the steps before or after it) to use a php file as the cacti log file. After having the malicious hostname end up in the logs (log poisoning), one can simply go to the log file url to execute commands to achieve RCE. This issue has been addressed in version 1.2.28 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

No affected versions have been published.

Timeline

Published: Oct 7, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-433648.2Cacti is an open source performance and fault management framework. The `title` parameter is not properly sanitized when saving external lin CVE-2024-433658.2Cacti is an open source performance and fault management framework. The`consolenewsection` parameter is not properly sanitized when saving e CVE-2024-433669.1zkvyper is a Vyper compiler. Starting in version 1.3.12 and prior to version 1.5.3, since LLL IR has no Turing-incompletness restrictions, i CVE-2024-433677.5Boa is an embeddable and experimental Javascript engine written in Rust. Starting in version 0.16 and prior to version 0.19.0, a wrong assum CVE-2024-433686.5The Trix editor, versions prior to 2.1.4, is vulnerable to XSS when pasting malicious code. This vulnerability is a bypass of the fix put in CVE-2024-433697.2Ibexa RichText Field Type is a Field Type for supporting rich formatted text stored in a structured XML format. In versions on the 4.6 branc CVE-2024-43377.4Adive Framework 2.0.8, does not sufficiently encode user-controlled inputs, resulting in a persistent Cross-Site Scripting (XSS) vulnerabili CVE-2024-433707.2gettext.js is a GNU gettext port for node and the browser. There is a cross-site scripting (XSS) injection if `.po` dictionary definition fi CVE-2024-433716.5CKAN is an open-source data management system for powering data hubs and data portals. There are a number of CKAN plugins, including XLoader CVE-2024-433737.8webcrack is a tool for reverse engineering javascript. An arbitrary file write vulnerability exists in the webcrack module when processing s CVE-2024-433744.7The UNIX editor Vim prior to version 9.1.0678 has a use-after-free error in argument list handling. When adding a new file to the argument l CVE-2024-433765.3Umbraco is an ASP.NET CMS. Some endpoints in the Management API can return stack trace information, even when Umbraco is not in debug mode.