Log in Start free

Vulnerability · Published Jan 27, 2025 · Assigned by GitHub_M

CVE-2024-45598Cacti has a Local File Inclusion (LFI) Vulnerability via Poller Standard Error Log Path

Medium 6.0

In plain English

A medium-severity path traversal in cacti from Cacti. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.0% (higher than 87% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.0Medium
Exploit odds (30 days)3.0%top 12.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Cacti is an open source performance and fault management framework. Prior to 1.2.29, an administrator can change the `Poller Standard Error Log Path` parameter in either Installation Step 5 or in Configuration->Settings->Paths tab to a local file inside the server. Then simply going to Logs tab and selecting the name of the local file will show its content on the web UI. This vulnerability is fixed in 1.2.29.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.21cacti1.2.29-r0ALPINE-CVE-2024-45598
Alpine:v3.22cacti1.2.29-r0ALPINE-CVE-2024-45598
Alpine:v3.23cacti1.2.29-r0ALPINE-CVE-2024-45598
Alpine:v3.24cacti1.2.29-r0ALPINE-CVE-2024-45598
Debian:12cacti1.2.24+ds1-1+deb12u5DSA-5862-1
Debian:12cacti1.2.24+ds1-1+deb12u5DEBIAN-CVE-2024-45598
Debian:13cacti1.2.28+ds1-4DEBIAN-CVE-2024-45598
Debian:14cacti1.2.28+ds1-4DEBIAN-CVE-2024-45598
Ubuntu:24.04:LTScactino fix listedUBUNTU-CVE-2024-45598
Ubuntu:25.10cactino fix listedUBUNTU-CVE-2024-45598

Affected products (as reported)

VendorProductVersions
Cacti cacti < 1.2.29

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L

References