CVE-2023-39358
Summary
| CVE | CVE-2023-39358 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2023-09-05 22:15:00 UTC |
|---|
| Updated | 2023-11-03 21:15:00 UTC |
|---|
| Description | Cacti is an open source operational monitoring and fault management framework. An authenticated SQL injection vulnerability was discovered which allows authenticated users to perform privilege escalation and remote code execution. The vulnerability resides in the `reports_user.php` file. In `ajax_get_branches`, the `tree_id` parameter is passed to the `reports_get_branch_select` function without any validation. This issue has been addressed in version 1.2.25. Users are advised to upgrade. There are no known workarounds for this vulnerability. |
|---|
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|
| [SECURITY] Fedora 37 Update: cacti-1.2.25-1.fc37 - package-announce - Fedora Mailing-Lists |
MISC |
lists.fedoraproject.org |
|
| Authenticated SQL injection vulnerability when managing reports · Advisory · Cacti/cacti · GitHub |
MISC |
github.com |
|
| [SECURITY] Fedora 38 Update: cacti-spine-1.2.25-1.fc38 - package-announce - Fedora Mailing-Lists |
MISC |
lists.fedoraproject.org |
|
| [SECURITY] Fedora 39 Update: cacti-spine-1.2.25-1.fc39 - package-announce - Fedora Mailing-Lists |
MISC |
lists.fedoraproject.org |
|
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 150720 Cacti Prior to 1.2.25 Multiple Security Vulnerabilities
- 284617 Fedora Security Update for cacti (FEDORA-2023-06a2a6e03c)
- 284618 Fedora Security Update for cacti (FEDORA-2023-6335ea9c0c)
- 285223 Fedora Security Update for cacti (FEDORA-2023-248dff7cbe)
- 505987 Alpine Linux Security Update for cacti
- 510697 Alpine Linux Security Update for cacti
