Medium severity6.1OSV Advisory· Published May 14, 2024· Updated Apr 15, 2026

CVE-2024-30268

Description

Cacti provides an operational monitoring and fault management framework. A reflected cross-site scripting vulnerability on the 1.3.x DEV branch allows attackers to obtain cookies of administrator and other users and fake their login using obtained cookies. This issue is fixed in commit a38b9046e9772612fda847b46308f9391a49891e.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Cacti (software)/CactiOSV2 versions
releaes/1.2.19, release/1.0.0, release/1.0.1, …+ 1 more
- (no CPE)range: releaes/1.2.19, release/1.0.0, release/1.0.1, …
- (no CPE)range: 1.3.x DEV branch

Patches

Vulnerability mechanics

References

github.com/Cacti/cacti/blob/08497b8bcc6a6037f7b1aae303ad8f7dfaf7364e/settings.phpnvd
github.com/Cacti/cacti/commit/a38b9046e9772612fda847b46308f9391a49891envd
github.com/Cacti/cacti/security/advisories/GHSA-9m3v-whmr-pc2qnvd

News mentions

No linked articles in our index yet.

cvss	0.397
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000