CVE-2023-50250

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-50250

5.4 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

C

acti is an open source operational monitoring and fault management framework. A reflection cross-site scripting vulnerability was discovered in version 1.2.25. Attackers can exploit this vulnerability to perform actions on behalf of other users. The vulnerability is found in `templates_import.php.` When uploading an xml template file, if the XML file does not pass the check, the server will give a JavaScript pop-up prompt, which contains unfiltered xml template file name, resulting in XSS. An attacker exploiting this vulnerability could execute actions on behalf of other users. This ability to impersonate users could lead to unauthorized changes to settings. As of time of publication, no patched versions are available.

References
Link Resource
https://github.com/Cacti/cacti/blob/5f6f65c215d663a775950b2d9db35edbaf07d680/templates_import.php Exploit Vendor Advisory
https://github.com/Cacti/cacti/security/advisories/GHSA-xwqc-7jc4-xm73 Exploit Vendor Advisory
https://lists.fedoraproject.org/archives/list/[email protected]/message/RBEOAFKRARQHTDIYSL723XAFJ2Q6624X/ Release Notes
https://github.com/Cacti/cacti/blob/5f6f65c215d663a775950b2d9db35edbaf07d680/templates_import.php Exploit Vendor Advisory
https://github.com/Cacti/cacti/security/advisories/GHSA-xwqc-7jc4-xm73 Exploit Vendor Advisory
https://lists.fedoraproject.org/archives/list/[email protected]/message/RBEOAFKRARQHTDIYSL723XAFJ2Q6624X/ Release Notes
Configurations

Configuration 1 (hide)

cpe:2.3:a:cacti:cacti:1.2.25:*:*:*:*:*:*:*
History

10 Apr 2025, 20:31

Type Values Removed Values Added
References () https://lists.fedoraproject.org/archives/list/[email protected]/message/RBEOAFKRARQHTDIYSL723XAFJ2Q6624X/ - () https://lists.fedoraproject.org/archives/list/[email protected]/message/RBEOAFKRARQHTDIYSL723XAFJ2Q6624X/ - Release Notes

13 Feb 2025, 18:15

Type Values Removed Values Added
Summary (en) Cacti is an open source operational monitoring and fault management framework. A reflection cross-site scripting vulnerability was discovered in version 1.2.25. Attackers can exploit this vulnerability to perform actions on behalf of other users. The vulnerability is found in `templates_import.php.` When uploading an xml template file, if the XML file does not pass the check, the server will give a JavaScript pop-up prompt, which contains unfiltered xml template file name, resulting in XSS. An attacker exploiting this vulnerability could execute actions on behalf of other users. This ability to impersonate users could lead to unauthorized changes to settings. As of time of publication, no patched versions are available. (en) Cacti is an open source operational monitoring and fault management framework. A reflection cross-site scripting vulnerability was discovered in version 1.2.25. Attackers can exploit this vulnerability to perform actions on behalf of other users. The vulnerability is found in `templates_import.php.` When uploading an xml template file, if the XML file does not pass the check, the server will give a JavaScript pop-up prompt, which contains unfiltered xml template file name, resulting in XSS. An attacker exploiting this vulnerability could execute actions on behalf of other users. This ability to impersonate users could lead to unauthorized changes to settings. As of time of publication, no patched versions are available.

21 Nov 2024, 08:36

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 6.1 		v2 : unknown
v3 : 5.4
References () https://github.com/Cacti/cacti/blob/5f6f65c215d663a775950b2d9db35edbaf07d680/templates_import.php - Exploit, Vendor Advisory () https://github.com/Cacti/cacti/blob/5f6f65c215d663a775950b2d9db35edbaf07d680/templates_import.php - Exploit, Vendor Advisory
References () https://github.com/Cacti/cacti/security/advisories/GHSA-xwqc-7jc4-xm73 - Exploit, Vendor Advisory () https://github.com/Cacti/cacti/security/advisories/GHSA-xwqc-7jc4-xm73 - Exploit, Vendor Advisory
References () https://lists.fedoraproject.org/archives/list/[email protected]/message/RBEOAFKRARQHTDIYSL723XAFJ2Q6624X/ - () https://lists.fedoraproject.org/archives/list/[email protected]/message/RBEOAFKRARQHTDIYSL723XAFJ2Q6624X/ -

10 Jun 2024, 17:16

Type Values Removed Values Added
References
  • () https://lists.fedoraproject.org/archives/list/[email protected]/message/RBEOAFKRARQHTDIYSL723XAFJ2Q6624X/ -
Information

Published : 2023-12-22 17:15

Updated : 2025-04-10 20:31

NVD link : CVE-2023-50250

Mitre link : CVE-2023-50250

CVE.ORG link : CVE-2023-50250

JSON object : View

Products Affected

cacti

CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')