PT-2023-9091 · Cacti+1 · Cacti+1

012Git012 · Publicado 2023-12-20 · Atualizado 2024-06-15 · CVE-2023-49084

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cacti (affected versions not specified)

Description The issue is related to incorrect handling of file names for PHP include or require functions in the link.php component, allowing an attacker to execute arbitrary code on the server. This can be achieved through SQL Injection and insufficient processing of the include file path. The exploitation of this issue is possible for an authorized user, and its impact is the execution of arbitrary code on the server.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Enumeração de Fraquezas

CWE-98

Identificadores relacionados

ALT-PU-2023-8407

ALT-PU-2024-1003

BDU:2024-03557

CVE-2023-49084

DLA-3765-1

DSA-5646-1

GHSA-CX8G-HVQ8-P2RV

GHSA-GJ3F-P326-GH8R

GHSA-PFH9-GWM6-86VP

OPENSUSE-SU-2024:0031-1

OPENSUSE-SU-2024:13533-1

Produtos afetados

Alt Linux

Cacti

Referências · 42

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/cacti_pollers_sqli_rce.rb · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/49xxx/CVE-2023-49084.json · Exploit
• 🔥 https://github.com/Cacti/cacti/security/advisories/GHSA-pfh9-gwm6-86vp · Exploit
• https://github.com/Cacti/cacti/commit/c3a647e9867ae8e2982e26342630ba9edb2d94b7 · Nota
• https://github.com/Cacti/cacti/commit/5f451bc680d7584525d18026836af2a1e31b2188 · Nota
• https://bugzilla.suse.com/1218360 · Nota
• https://suse.com/security/cve/CVE-2023-49085 · Nota
• https://suse.com/security/cve/CVE-2023-49084 · Nota
• https://lists.debian.org/debian-lts-announce/2024/03/msg00018.html · Nota
• https://lists.opensuse.org/archives/list/[e-mail]/thread/IZJKJNYP7JFJ3XMRIGZT22J5DIAVPSY7 · Nota
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/RBEOAFKRARQHTDIYSL723XAFJ2Q6624X · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-49084 · Nota de Segurança
• https://suse.com/security/cve/CVE-2023-51448 · Nota
• https://bugzilla.suse.com/1218379 · Nota
• https://osv.dev/vulnerability/openSUSE-SU-2024:13533-1 · Aviso do Fabricante