CVE-2024-43364: 
Cacti vulnerability analysis and mitigation

CVE-2024-43364 affects Cacti, an open source performance and fault management framework. The vulnerability was discovered and disclosed on October 7, 2024, and involves a stored Cross-Site Scripting (XSS) vulnerability in the external links functionality. The issue exists in versions prior to 1.2.28, where the 'title' parameter is not properly sanitized when saving external links in links.php (GitHub Advisory).

The vulnerability occurs when the 'title' parameter in links.php is not properly sanitized during the creation of external links. The unsanitized input is stored in the database and subsequently reflected back to users in index.php, leading to stored XSS. The vulnerability has been assigned a CVSS v3.1 base score of 8.2 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:H (NVD).

The vulnerability allows users with privileges to create external links to perform stored XSS attacks. While the impact is somewhat limited due to restrictions on the length of strings that can be entered in the title parameter, successful exploitation could potentially lead to session hijacking, credential theft, or redirection to malicious websites (Security Online).

The vulnerability has been patched in Cacti version 1.2.28. All users are advised to upgrade to this version immediately. There are no known workarounds for this vulnerability (NVD).