CVE-2024-43364

CVE-2024-43364 is a stored cross-site scripting (XSS) vulnerability in Cacti, an open-source performance and fault management framework, caused by insufficient sanitization of the 'title' parameter when saving external links in links.php. An attacker with the privilege to create external links can tamper with the 'title' parameter in the HTTP POST request; the injected value is stored in the database and later reflected back to users via index.php, where the script executes in their browsers. Successful exploitation allows arbitrary script execution in the context of authenticated Cacti users who view the affected pages, with scope-changing confidentiality, integrity, and availability impacts reflected in its 8.2 (High) CVSS score. All Cacti instances running versions before 1.2.28 are affected, and there are no known workarounds. There is no evidence of in-the-wild exploitation and it is not in CISA KEV, but a public advisory is available and EPSS assigns a 35.8% probability of exploitation within 30 days (98th percentile).

What to do: Upgrade to Cacti 1.2.28 or later; there are no known workarounds, so patching is the only remediation. Until patched, restrict the privilege to create external links to trusted users and review existing external link titles for injected HTML or script. Given the elevated EPSS probability, prioritize updating internet-reachable Cacti servers.