Open redirect in change password functionality in Cacti
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Spoofing
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-601.
Summary
Cacti is an open source operational monitoring and fault management framework. In Cacti 1.2.24, users with console access can be redirected to an arbitrary website after a change password performed via a specifically crafted URL. The `auth_changepassword.php` file accepts `ref` as a URL parameter and reflects it in the form used to perform the change password. It's value is used to perform a redirect via `header` PHP function. A user can be tricked in performing the change password operation, e.g., via a phishing message, and then interacting with the malicious website where the redirection has been performed, e.g., downloading malwares, providing credentials, etc. This issue has been addressed in version 1.2.25. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Cacti | cacti | before 1.2.25 | 1.2.25 | Patch available | CNA |
- cacti VendorCacti Affected before 1.2.25 Fixed in 1.2.25 Patch available CNA
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:cacti:cacti:1.2.24:*:*:*:*:*:*:* | 1.2.24 | Vulnerable | Cacti |
| cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* | 37 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* | 38 | Vulnerable | Fedoraproject |
- cpe:2.3:a:cacti:cacti:1.2.24:*:*:*:*:*:*:* Versions 1.2.24 Vulnerable ·Cacti
- cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* Versions 37 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* Versions 38 Vulnerable ·Fedoraproject
Remediation
- Fix · CNA cacti (Cacti) Fixed in 1.2.25
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2023-39364
References
Other 5
- https://lists.fedoraproject.org/archives/list/[email protected]/message/WZGB2UXJEUYWWA6IWVFQ3ZTP22FIHMGN/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/CFH3J2WVBKY4ZJNMARVOWJQK6PSLPHFH/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/WOQFYGLZBAWT4AWNMO7DU73QXWPXTCKH/
- https://www.debian.org/security/2023/dsa-5550
- https://lists.debian.org/debian-lts-announce/2024/03/msg00018.html
More Cacti vulnerabilities
- TI-2022-22813 Unauthenticated command injection in cacti KEVCVSS 3.1CRITICAL 9.8
- TI-2023-20500 Unauthenticated SQL Injection in graph_view.php in Cacti CVSS 3.1CRITICAL 9.8
- TI-2024-16869 Cacti RCE vulnerability when importing packages CVSS 3.1CRITICAL 9.1
- TI-2024-20809 SQL Injection vulnerability in automation_get_new_graphs_sql CVSS 3.1HIGH 8.8
- TI-2023-26750 Cacti SQL Injection vulnerability CVSS 3.1HIGH 8.8
- TI-2025-18110 Cacti allows Arbitrary File Creation leading to RCE CVSS 4.0HIGH 8.7
Sources
- CVE-2023-39364 · CVE Program
- CVE-2023-39364 · NVD
- FIRST EPSS
- CVE-2023-39364 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences