Reflected Cross-Site Scripting in Cacti

Executive Summary

This vulnerability is a Reflected Cross-Site Scripting (XSS) issue found in Cacti, an open source performance and fault management framework. It affects versions 1.2.30 and below, specifically in the html_auth_footer component. Reflected XSS occurs when malicious scripts are reflected off a web server, potentially allowing attackers to execute scripts in the context of a victim's browser.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade Cacti to version 1.2.31 or later, as this version contains the fix for the Reflected XSS vulnerability in the html_auth_footer.

Useful 0 Not Useful 0

Impact Analysis

The Reflected XSS vulnerability can allow attackers to execute malicious scripts in the browsers of users who visit the affected Cacti instance. This can lead to theft of session cookies, defacement, or redirection to malicious sites, potentially compromising user data or system integrity.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify how the CVE-2026-39897 vulnerability affects compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Detection Guidance

CVE-2026-39897 is a reflected Cross-Site Scripting (XSS) vulnerability in the html_auth_footer of Cacti versions 1.2.30 and below. Detection typically involves testing the affected web pages for reflected input that is not properly sanitized.

To detect this vulnerability on your system, you can perform manual or automated testing by sending crafted HTTP requests to the Cacti web interface and observing if injected scripts are reflected in the html_auth_footer without proper encoding.

• Use curl or similar tools to send HTTP requests with XSS payloads in parameters that might be reflected in the html_auth_footer.
• Example curl command to test for reflected XSS (replace <cacti_url> with your target URL):
• curl -v "http://<cacti_url>/index.php?someparam=<script>alert(1)</script>"

If the response contains the injected script in the html_auth_footer without encoding or sanitization, the system is vulnerable.

Additionally, web vulnerability scanners that test for reflected XSS can be used against the Cacti interface to automate detection.

Useful 0 Not Useful 0