CVE-2023-49088 Cacti has incomplete fix for CVE-2023-39515

Medium 6.1 Published 22 Dec 2023 Updated 25 Feb 2026

An authenticated attacker can execute malicious code in a victim's browser via stored XSS in Cacti's data debug page.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2023-49088?

CVE-2023-49088 is a medium-severity cross-site scripting vulnerability in Cacti Cacti, published on 22 Dec 2023. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.

Official description

Cacti is an open source operational monitoring and fault management framework. The fix applied for CVE-2023-39515 in version 1.2.25 is incomplete as it enables an adversary to have a victim browser execute malicious code when a victim user hovers their mouse over the malicious data source path in `data_debug.php`. To perform the cross-site scripting attack, the adversary needs to be an authorized cacti user with the following permissions: `General Administration>Sites/Devices/Data`. The victim of this attack could be any account with permissions to view `http://<HOST>/cacti/data_debug.php`. As of time of publication, no complete fix has been included in Cacti.

Weakness: CWE-79

Which versions are affected by CVE-2023-49088?

It affects 1 product.

Products include Cacti Cacti.

How do I fix CVE-2023-49088?

No fix published yet.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2023-49088 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-49088 exists.

All Cacti Cacti vulnerabilities

Sources

Also known as CLEANSTART-2024-IP82482, DEBIAN-CVE-2023-49088, UBUNTU-CVE-2023-49088.