CVE-2021-23225

Name of the Vulnerable Software and Affected Versions Cacti version 1.1.38

Description The issue allows authenticated users with User Management permissions to inject arbitrary web script or HTML in the new username field during creation of a new user via the "Copy" method at the "user admin.php" endpoint.

Recommendations For Cacti version 1.1.38, consider restricting access to the "Copy" method in user admin.php to prevent exploitation until a fix is available. As a temporary workaround, avoid using the new username field for user creation until the issue is resolved.