https://bugzilla.suse.com/show_bug.cgi?id=1218366 Bug ID: 1218366 Summary: VUL-0: CVE-2023-49086: cacti: XSS when adding new devices Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/389161/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: pstivanin@suse.com Reporter: smash_bz@suse.de QA Contact: security-team@suse.de CC: andrea.mattiazzo@suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- Cacti is a robust performance and fault management framework and a frontend to RRDTool - a Time Series Database (TSDB). Bypassing an earlier fix (CVE-2023-39360) that leads to a DOM XSS attack. Exploitation of the vulnerability is possible for an authorized user. The vulnerable component is the `graphs_new.php`. Impact of the vulnerability - execution of arbitrary javascript code in the attacked user's browser. This issue has been patched in version 1.2.26. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-49086 https://github.com/Cacti/cacti/security/advisories/GHSA-wc73-r2vw-59pr -- You are receiving this mail because: You are on the CC list for the bug.