Description
Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a SQL injection discovered in graph_view.php. Since guest users can access graph_view.php without authentication by default, if guest users are being utilized in an enabled state, there could be the potential for significant damage. Attackers may exploit this vulnerability, and there may be possibilities for actions such as the usurpation of administrative privileges or remote code execution. This issue has been addressed in version 1.2.25. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Analysis
No analysis available yet.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Cacti | cacti | affected |
|
Configuration 1 [-]
|
Configuration 2 [-]
|
No data.
No data available yet.
Remediation
No remediation available yet.
Tracking
Sign in to view the affected projects.
Advisories
| Source | ID | Title |
|---|---|---|
 Debian DLA |
DLA-3765-1 | cacti security update |
 Debian DSA |
DSA-5550-1 | cacti security update |
 Ubuntu USN |
USN-6720-1 | Cacti vulnerability |
References
History
No history.
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2025-02-13T17:02:59.388Z
Reserved: 2023-07-28T13:26:46.480Z
Link: CVE-2023-39361
Vulnrichment
No data.
NVD
Status : Modified
Published: 2023-09-05T21:15:46.880
Modified: 2024-11-21T08:15:14.423
Link: CVE-2023-39361
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses