CVE catalog

CVE-2024-43364

cacti affected and fixed versions

[CVE catalog]

Cacti is an open source performance and fault management framework. The `title` parameter is not properly sanitized when saving external links in links.php . Morever, the said title parameter is stored in the database and reflected back to user in index.php, finally leading to stored XSS. Users with the privilege to create external links can manipulate the `title` parameter in the http post request while creating external links to perform stored XSS attacks. The vulnerability known as XSS (Cross-Site Scripting) occurs when an application allows untrusted user input to be displayed on a web page without proper validation or escaping. This issue has been addressed in release version 1.2.28. All users are advised to upgrade. There are no known workarounds for this vulnerability.

Severity
High · CVSS 8.2CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:H
Published
Source
[NVD] · [CVE record]
EPSS
37.88% · Oct 27, 2026

Projects and upstream resources

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Version impact has not been established. The original provider fields are retained below.

Provider details and historical evidence
Original provider fields
{
  "package_releases": [
    {
      "name": "cacti",
      "status": "fixed",
      "release": "sid",
      "version": "1.2.31+ds1-4"
    },
    {
      "name": "cacti",
      "status": "fixed",
      "release": "forky",
      "version": "1.2.31+ds1-4"
    },
    {
      "name": "cacti",
      "status": "fixed",
      "release": "trixie",
      "version": "1.2.30+ds1-1"
    },
    {
      "name": "cacti",
      "status": "fixed",
      "release": "bookworm",
      "version": "1.2.24+ds1-1+deb12u5"
    },
    {
      "name": "cacti",
      "status": "fixed",
      "release": "bookworm-security",
      "version": "1.2.24+ds1-1+deb12u5"
    }
  ],
  "fixed_versions": [
    {
      "bug": null,
      "name": "cacti",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "not yet assigned",
      "fixed_version": "1.2.28+ds1-1"
    },
    {
      "bug": null,
      "name": "cacti",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "not yet assigned",
      "fixed_version": "1.2.28+ds1-1"
    },
    {
      "bug": null,
      "name": "cacti",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "not yet assigned",
      "fixed_version": "1.2.28+ds1-1"
    },
    {
      "bug": null,
      "name": "cacti",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "not yet assigned",
      "fixed_version": "1.2.24+ds1-1+deb12u5"
    }
  ],
  "distribution_packages": []
}

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • [cacti]Unknown
    Details (4)

    • 1.2.24+ds1-1+deb12u5 · all · bookworm

      Fixed · Fixed: 1.2.24+ds1-1+deb12u5

      dsa · cacti · debian · bookworm; dsa · cacti · debian · 12

    • 1.2.24+ds1-1+deb12u5 · all · bookworm

      Fixed · Fixed: 1.2.24+ds1-1+deb12u5

      dsa · cacti · debian · bookworm; dsa · cacti · debian · 12

    • 1.2.24+ds1-1+deb12u5 · all · bookworm-security

      Fixed · Fixed: 1.2.24+ds1-1+deb12u5

      dsa · cacti · debian · bookworm; dsa · cacti · debian · 12

    • 1.2.24+ds1-1+deb12u5 · all · bookworm-security

      Fixed · Fixed: 1.2.24+ds1-1+deb12u5

      dsa · cacti · debian · bookworm; dsa · cacti · debian · 12

[Debian 13 (Trixie)]

  • [cacti]Unknown
    Details (2)

    • 1.2.30+ds1-1 · all · trixie

      Fixed · Fixed: 1.2.28+ds1-1

      dsa · cacti · debian · 13

    • 1.2.30+ds1-1 · all · trixie

      Fixed · Fixed: 1.2.28+ds1-1

      dsa · cacti · debian · 13

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]