2023-09-05 21:09:28
GitHub_M
PUBLISHED
Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting (XSS) Vulnerability which allows an authenticated user to poison data stored in the _cacti_s database. These data will be viewed by administrative _cacti_ accounts and execute JavaScript code in the victims browser at view-time. The script under `data_sources.php` displays the data source management information (e.g. data source path, polling configuration etc.) for different data visualizations of the _cacti_ app. CENSUS found that an adversary that is able to configure a malicious data-source path, can deploy a stored XSS attack against any user of the same (or broader) privileges. A user that possesses the General Administration>Sites/Devices/Data permissions can configure the data source path in Cacti. This configuration occurs through `http://