PT-2019-4637 · Cacti+2 · Cacti+2

Published 2019-12-11 · Updated 2025-01-24 · CVE-2019-17358

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:S/C:N/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cacti versions prior to 1.2.8

Description The issue is related to insufficient deserialization mechanisms in the lib/functions.php component of the Cacti network monitoring tool. This could allow a remote attacker to compromise data integrity or cause a denial of service. An authenticated attacker may exploit this to influence object data values and control actions taken by Cacti, potentially causing memory corruption in the PHP module.

Recommendations For Cacti versions prior to 1.2.8, update to version 1.2.8 or later to resolve the issue. As a temporary workaround, consider restricting access to the lib/functions.php component to minimize the risk of exploitation.

Exploit

Fix

Deserialization of Untrusted Data

Memory Corruption

Weakness Enumeration

CWE-502

CWE-787

Related Identifiers

ALT-PU-2020-1488

ALT-PU-2020-3430

ALT-PU-2025-1813

BDU:2020-00798

CVE-2019-17358

DLA-2032-1

DSA-4604-1

OPENSUSE-SU-2020:0272-1

OPENSUSE-SU-2020:0284-1

OPENSUSE-SU-2020:0558-1

OPENSUSE-SU-2020:0565-1

OPENSUSE-SU-2020_0272-1

OPENSUSE-SU-2020_0558-1

OPENSUSE-SU-2024:10670-1

Affected Products

Alt Linux

Cacti

Suse

References · 100

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/cacti_package_import_rce.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/cacti_unauthenticated_cmd_injection.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/cacti_pollers_sqli_rce.rb · Exploit
• 🔥 https://github.com/Cacti/cacti/blob/79f29cddb5eb05cbaff486cd634285ef1fed9326/lib/functions.php#L3109 · Exploit
• 🔥 https://github.com/mhaskar/CVE-2020-8813 · Exploit
• 🔥 https://github.com/0xf4n9x/CVE-2022-46169 · Exploit
• 🔥 https://github.com/FredBrave/CVE-2022-46169-CACTI-1.2.22 · Exploit
• 🔥 https://github.com/sAsPeCt488/CVE-2022-46169 · Exploit
• 🔥 https://github.com/ariyaadinatha/cacti-cve-2022-46169-exploit · Exploit
• 🔥 https://github.com/botfather0x0/CVE-2022-46169 · Exploit
• 🔥 https://github.com/c3rrberu5/CVE-2022-46169 · Exploit
• 🔥 https://github.com/Anthonyc3rb3ru5/CVE-2022-46169 · Exploit
• 🔥 https://github.com/deadyP00l/CVE-2022-46169 · Exploit
• 🔥 https://github.com/thisisveryfunny/CVE-2024-25641-RCE-Automated-Exploit-Cacti-1.2.26 · Exploit
• 🔥 https://github.com/p0dalirius/CVE-2020-8813-Cacti-RCE-in-graph_realtime · Exploit