CVE-2023-39513: 
Cacti vulnerability analysis and mitigation

Cacti, an open source operational monitoring and fault management framework, was found to contain a Stored Cross-Site-Scripting (XSS) vulnerability identified as CVE-2023-39513. The vulnerability was discovered in September 2023 and affects versions prior to 1.2.25. The vulnerability allows an authenticated user with Template Editor>Data Queries permissions to poison data stored in the Cacti's database that will be executed when viewed by administrative accounts (GitHub Advisory).

The vulnerability exists in the host.php script which is used to monitor and manage hosts in the Cacti app. An adversary with Template Editor>Data Queries permissions can configure a data-query template with malicious code appended in the template path through http:///cacti/data_queries.php. When a verbose data query is requested, the formatted template path is rendered in the device's management page without proper HTML escaping, enabling a stored XSS attack. The vulnerability has been assigned a CVSS v3.1 base score of 6.1 MEDIUM (Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N) (GitHub Advisory).

When exploited, this vulnerability allows attackers to execute arbitrary JavaScript code in victims' browsers, potentially leading to account takeover, performing unauthorized actions on the platform, redirecting users to malicious websites, stealing sensitive information, or participating in browser-based attacks. The impact is particularly severe as it affects administrative Cacti accounts that have General Administration>Sites/Devices/Data privileges (GitHub Advisory).

The vulnerability has been patched in Cacti version 1.2.25. Users are strongly advised to upgrade to this version or later. For users unable to update immediately, it is recommended to manually filter HTML output and restrict access to Template Editor>Data Queries permissions. Multiple Linux distributions have released security updates addressing this vulnerability, including Debian, Fedora, and Ubuntu (Debian Security, Fedora Update).