CVE-2024-43365

Cacti versions prior to 1.2.28 fail to properly sanitize the 'consolenewsection' parameter when saving external links in links.php, allowing script injection that is stored in the database and later rendered to users via index.php, resulting in stored cross-site scripting (CWE-79). An attacker needs an account with the privilege to create external links and submits a crafted HTTP POST with malicious content in that parameter; when other users view the Cacti console, the injected script executes in their browser sessions. Successful exploitation could allow the attacker to hijack sessions, steal information, or take actions in the context of other Cacti users, with the CVSS vector reflecting changed scope and a high availability impact. Any Cacti deployment that permits non-administrator users to create external links is affected, and the maintainers report no workarounds. No in-the-wild exploitation is confirmed (not in CISA KEV), but a public proof-of-concept reference exists via the GitHub security advisory, and EPSS assigns a 23.5% probability of exploitation within 30 days (98th percentile), indicating elevated risk.

What to do: Upgrade all Cacti installations to version 1.2.28 or later, as no workarounds are available. Until patching is complete, restrict the privilege to create external links to trusted administrators and review existing external link entries for unexpected script content. Check web logs for HTTP POST requests to links.php containing unusual or script-bearing consolenewsection values that could indicate exploitation.