Bugzilla – Bug 1215044
VUL-0: CVE-2023-39360: cacti: Cross-Site Scripting vulnerability when creating new graphs
Last modified: 2023-09-26 19:10:15 UTC
CVE-2023-39360 Cacti is an open source operational monitoring and fault management framework.Affected versions are subject to a Stored Cross-Site-Scripting (XSS) Vulnerability allows an authenticated user to poison data. The vulnerability is found in `graphs_new.php`. Several validations are performed, but the `returnto` parameter is directly passed to `form_save_button`. In order to bypass this validation, returnto must contain `host.php`. This vulnerability has been addressed in version 1.2.25. Users are advised to upgrade. Users unable to update should manually filter HTML output. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-39360 https://bugzilla.redhat.com/show_bug.cgi?id=2237590 https://www.cve.org/CVERecord?id=CVE-2023-39360 https://github.com/Cacti/cacti/security/advisories/GHSA-gx8c-xvjh-9qh4
Affected: - openSUSE:Factory/cacti 1.2.24 - openSUSE:Backports:SLE-15-SP4/cacti 1.2.20 - openSUSE:Backports:SLE-15-SP5/cacti 1.2.23
submitted
This is an autogenerated message for OBS integration: This bug (1215044) was mentioned in https://build.opensuse.org/request/show/1109347 Factory / cacti https://build.opensuse.org/request/show/1109349 Backports:SLE-12+Backports:SLE-15-SP4+Backports:SLE-15-SP5 / cacti+cacti-spine
done, closing
Reopening: Maintenance release request is still open, and waiting for reviews from qam-openqa and backports-reviewers. https://build.opensuse.org/request/show/1109493
openSUSE-SU-2023:0275-1: An update that fixes 17 vulnerabilities is now available. Category: security (important) Bug References: 1215040,1215042,1215043,1215044,1215045,1215047,1215050,1215051,1215052,1215053,1215054,1215055,1215056,1215058,1215059,1215081,1215082 CVE References: CVE-2023-30534,CVE-2023-39357,CVE-2023-39358,CVE-2023-39359,CVE-2023-39360,CVE-2023-39361,CVE-2023-39362,CVE-2023-39364,CVE-2023-39365,CVE-2023-39366,CVE-2023-39510,CVE-2023-39511,CVE-2023-39512,CVE-2023-39513,CVE-2023-39514,CVE-2023-39515,CVE-2023-39516 JIRA References: Sources used: SUSE Package Hub for SUSE Linux Enterprise 12 (src): cacti-1.2.25-35.1, cacti-spine-1.2.25-29.1
openSUSE-SU-2023:0275-1: An update that fixes 17 vulnerabilities is now available. Category: security (important) Bug References: 1215040,1215042,1215043,1215044,1215045,1215047,1215050,1215051,1215052,1215053,1215054,1215055,1215056,1215058,1215059,1215081,1215082 CVE References: CVE-2023-30534,CVE-2023-39357,CVE-2023-39358,CVE-2023-39359,CVE-2023-39360,CVE-2023-39361,CVE-2023-39362,CVE-2023-39364,CVE-2023-39365,CVE-2023-39366,CVE-2023-39510,CVE-2023-39511,CVE-2023-39512,CVE-2023-39513,CVE-2023-39514,CVE-2023-39515,CVE-2023-39516 JIRA References: Sources used: openSUSE Backports SLE-15-SP5 (src): cacti-1.2.25-bp155.2.3.1, cacti-spine-1.2.25-bp155.2.3.1 openSUSE Backports SLE-15-SP4 (src): cacti-1.2.25-bp154.2.9.1, cacti-spine-1.2.25-bp154.2.9.1 SUSE Package Hub for SUSE Linux Enterprise 12 (src): cacti-1.2.25-35.1, cacti-spine-1.2.25-29.1
all done now, closing