Skip to content
OpenAdvisories
High WID-SEC-2023-3221 7 CVEs

Cacti: Mehrere Schwachstellen

Published Dec 26, 2023 · Updated May 21, 2024 · Revision 5 · de-DE

Vendor: amazon Vendor: Debian Vendor: Fedora Product: Linux Product: Linux Product: Linux 2 Platform: Linux Platform: macOS Platform: Windows

Summary

Ein entfernter, anonymer oder authentifizierter Angreifer kann mehrere Schwachstellen in Cacti ausnutzen, um vertrauliche Informationen offenzulegen, Dateien zu manipulieren und beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen oder XSS-Angriffe durchzuführen.

Product

Cacti ist ein grafisches Frontend zur Visualisierung von statistischen Daten, erfasst durch die Round Robin Database rrdtool.

Vulnerabilities 7

  • High 8.8
    CVE-2023-49085 Public exploit EPSS 74%

    Cacti SQL Injection vulnerability

    Cacti provides an operational monitoring and fault management framework. In versions 1.2.25 and prior, it is possible to execute arbitrary SQL code through the `pollers.php` script. An authorized user may be able to execute arbitrary SQL code. The vulnerable …

    Cacti cacti cacti cacti Debian Ubuntu Alpine
  • High 8.8
    CVE-2023-51448 EPSS 67%

    SQL Injection vulnerability when managing SNMP Notification Receivers

    Cacti provides an operational monitoring and fault management framework. Version 1.2.25 has a Blind SQL Injection (SQLi) vulnerability within the SNMP Notification Receivers feature in the file `‘managers.php’`. An authenticated attacker with the “Settings/Ut…

    Cacti cacti cacti cacti Debian Ubuntu Alpine
  • High 8.1
    CVE-2023-49084 Public exploit EPSS 64%

    Local File Inclusion (RCE) in Cacti

    Cacti is a robust performance and fault management framework and a frontend to RRDTool - a Time Series Database (TSDB). While using the detected SQL Injection and insufficient processing of the include file path, it is possible to execute arbitrary code on th…

    Cacti cacti cacti cacti Debian Ubuntu Alpine
  • Medium 6.1
    CVE-2023-49088

    Cacti has incomplete fix for CVE-2023-39515

    Cacti is an open source operational monitoring and fault management framework. The fix applied for CVE-2023-39515 in version 1.2.25 is incomplete as it enables an adversary to have a victim browser execute malicious code when a victim user hovers their mouse …

    Cacti cacti cacti cacti Debian Ubuntu Alpine
  • Medium 5.4
    CVE-2023-49086

    Cacti is vulnerable to cross-Site scripting (XSS) DOM

    Cacti is a robust performance and fault management framework and a frontend to RRDTool - a Time Series Database (TSDB). A vulnerability in versions prior to 1.2.27 bypasses an earlier fix for CVE-2023-39360, therefore leading to a DOM XSS attack. Exploitation…

    Cacti cacti cacti cacti Debian Ubuntu Alpine
  • Medium 5.4
    CVE-2023-50250

    Cross-Site Scripting vulnerability when Import xml template file

    Cacti is an open source operational monitoring and fault management framework. A reflection cross-site scripting vulnerability was discovered in version 1.2.25. Attackers can exploit this vulnerability to perform actions on behalf of other users. The vulnerab…

    Cacti cacti cacti cacti Debian Ubuntu Alpine
  • Unscored —
    CVE-2023-50569 Rejected

    DO NOT USE THIS CVE RECORD. Consult IDs: CVE-2023-50250. Reason: This record is a reservation duplicate of CVE-2023-502…

    cacti Alpine

Revision history

  1. #5

    Neue Updates von Fedora aufgenommen

  2. #4

    Neue Updates von Debian aufgenommen

  3. #3

    Neue Updates von Debian aufgenommen

  4. #2

    Neue Updates von Amazon aufgenommen

  5. #1

    Initiale Fassung

References