Log in Start free

Vulnerability · Published Sep 5, 2023 · Assigned by GitHub_M

CVE-2023-39361Unauthenticated SQL Injection in graph_view.php in Cacti

Critical 9.8

In plain English

A critical-severity SQL injection in cacti from Cacti. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 88.8% (higher than 99.8% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)88.8%top 0.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling2Nuclei, Public PoC

Official description

Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a SQL injection discovered in graph_view.php. Since guest users can access graph_view.php without authentication by default, if guest users are being utilized in an enabled state, there could be the potential for significant damage. Attackers may exploit this vulnerability, and there may be possibilities for actions such as the usurpation of administrative privileges or remote code execution. This issue has been addressed in version 1.2.25. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20cacti1.2.25-r0ALPINE-CVE-2023-39361
Alpine:v3.21cacti1.2.25-r0ALPINE-CVE-2023-39361
Alpine:v3.22cacti1.2.25-r0ALPINE-CVE-2023-39361
Alpine:v3.23cacti1.2.25-r0ALPINE-CVE-2023-39361
Alpine:v3.24cacti1.2.25-r0ALPINE-CVE-2023-39361
Debian:12cacti1.2.24+ds1-1+deb12u1DEBIAN-CVE-2023-39361
Debian:12cacti1.2.24+ds1-1+deb12u1DSA-5550-1
Debian:13cacti1.2.25+ds1-1DEBIAN-CVE-2023-39361
Debian:14cacti1.2.25+ds1-1DEBIAN-CVE-2023-39361
Ubuntu:24.04:LTScacti1.2.25+ds1-2UBUNTU-CVE-2023-39361

Affected products (as reported)

VendorProductVersions
Cacti cacti < 1.2.25

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References