PT-2026-52625 · Cacti · Cacti

Publicado 2026-06-25 · Atualizado 2026-06-25 · CVE-2026-40082

NVD

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have missing session regenerate id() after login, leading to Session Fixation. session regenerate id() is NOT called after successful login. The login flow at auth login.php:203-207 directly sets $ SESSION[SESS USER ID] without rotating the session ID. The session cookie configuration is otherwise good (httponly=true, samesite=Strict, secure=true for HTTPS at include/global.php:513-537), but these do not prevent session fixation via same-site vectors. This issue has been fixed in version 1.2.31.

Correção

Session Fixation

Enumeração de Fraquezas

CWE-384

Identificadores relacionados

CVE-2026-40082

Produtos afetados

Cacti

Referências · 4

• https://github.com/Cacti/cacti/releases/tag/release%2F1.2.31 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-40082 · Nota de Segurança
• https://github.com/Cacti/cacti/security/advisories/GHSA-273r-qr93-wgcp · Nota
• https://github.com/Cacti/cacti/commit/2fa404e70a5702be10682555911228e8e51ba198 · Nota