Open Redirect in Cacti
CVE-2023-39364
Cacti is an open source operational monitoring and fault management framework. In Cacti 1.2.24, users with console access can be redirected to an arbitrary website after a change password performed via a specifically crafted URL. The `auth_changepassword.php` file accepts `ref` as a URL parameter and reflects it in the form used to perform the change password. It's value is used to perform a redirect via `header` PHP function. A user can be tricked in performing the change password operation, e.g., via a phishing message, and then interacting with the malicious website where the redirection has been performed, e.g., downloading malwares, providing credentials, etc. This issue has been addressed in version 1.2.25. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Vulnerability class: Open Redirect
EPSS: 0.006 (46.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 3.5 (Low). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N.
Affected products
- Cacti — versions 1.2.24, < 1.2.25
- Fedoraproject Fedora — versions 37, 38
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security-advisories@github.com (x_refsource_CONFIRM, Exploit, Vendor Advisory)
- security-advisories@github.com (Mailing List)
- security-advisories@github.com (Mailing List)
- security-advisories@github.com
- security-advisories@github.com
- security-advisories@github.com
Frequently asked questions
- What is CVE-2023-39364?
- CVE-2023-39364 is a low-severity vulnerability in Cacti, classified under URL Redirection to Untrusted Site (Open Redirect). CVSS score: 3.5/10. Published 2023-09-05.
- How severe is CVE-2023-39364?
- Low severity. CVSS v3 base score is 3.5 out of 10.
- Is CVE-2023-39364 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.