CVE-2024-31444 Common Vulnerabilities and Exposures

Upstream information

CVE-2024-31444 at MITRE

Description

Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, some of the data stored in `automation_tree_rules_form_save()` function in `automation_tree_rules.php` is not thoroughly checked and is used to concatenate the HTML statement in `form_confirm()` function from `lib/html.php` , finally resulting in cross-site scripting. Version 1.2.27 contains a patch for the issue.

SUSE information

Overall state of this security issue: Resolved

This issue is currently rated as having moderate severity.

SUSE Bugzilla entry: 1224236 [RESOLVED / FIXED]

SUSE Security Advisories:

openSUSE-SU-2024:0274-1, published Mon Sep 2 16:48:16 2024
openSUSE-SU-2024:0276-1, published Tue Sep 3 00:48:11 2024

List of released packages

Product(s)	Fixed package version(s)	References
SUSE Package Hub 12	`cacti >= 1.2.27-41.1` `cacti-spine >= 1.2.27-35.1`	Patchnames: openSUSE-2024-274
SUSE Package Hub 15 SP5	`cacti >= 1.2.27-bp155.2.9.1` `cacti-spine >= 1.2.27-bp155.2.9.1`	Patchnames: openSUSE-2024-274
SUSE Package Hub 15 SP6	`cacti >= 1.2.27-bp156.2.3.1` `cacti-spine >= 1.2.27-bp156.2.3.1`	Patchnames: openSUSE-2024-276
openSUSE Leap 15.5	`cacti >= 1.2.27-bp155.2.9.1` `cacti-spine >= 1.2.27-bp155.2.9.1`	Patchnames: openSUSE-2024-274
openSUSE Leap 15.6	`cacti >= 1.2.27-bp156.2.3.1` `cacti-spine >= 1.2.27-bp156.2.3.1`	Patchnames: openSUSE-2024-276
openSUSE Tumbleweed	`cacti >= 1.2.27-1.1`	Patchnames: openSUSE-Tumbleweed-2024-13962

SUSE Timeline for this CVE

CVE page created: Tue May 14 18:12:48 2024
CVE page last modified: Tue Sep 3 19:34:27 2024