PT-2019-5226 · Cacti+2 · Cacti+2
Eldar Marcussen
·
Published
2019-09-23
·
Updated
2025-01-24
·
CVE-2019-17357
CVSS v2.0
6.8
Medium
| Vector | AV:N/AC:L/Au:S/C:C/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Cacti versions prior to 1.2.8
Description
The issue affects how template identifiers are handled in Cacti when a string and a composite id value are used. This can be exploited by an authenticated attacker to extract data from the database. Additionally, an unauthenticated remote attacker could exploit this via a Cross-Site Request Forgery attack. The vulnerability is related to the
template id function in the graphs.php file.Recommendations
For versions prior to 1.2.8, update to version 1.2.8 or later to resolve the issue.
As a temporary workaround, consider restricting access to the
graphs.php file and the template id parameter to minimize the risk of exploitation.Exploit
Fix
SQL injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Cacti
Suse