PT-2023-5432 · Cacti+1 · Cacti+1

Published 2023-08-10 · Updated 2025-01-24 · CVE-2023-37543

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cacti versions prior to 1.2.6

Description The issue is related to an Insecure Direct Object Reference (IDOR) in the graph xport.php component, allowing unauthorized access to any graph via a modified local graph id parameter. This can enable a remote attacker to gain unauthorized access to protected information due to an error in handling user-controlled authorization keys.

Recommendations For versions prior to 1.2.6, update to version 1.2.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the graph xport.php component until a patch is applied. Avoid using the modified local graph id parameter in the graph xport.php endpoint until the issue is resolved.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

ALT-PU-2025-1813

BDU:2023-06062

CVE-2023-37543

GHSA-4X82-8W8M-W8HJ

Affected Products

Alt Linux

Cacti

References · 13

• 🔥 https://medium.com/@hussainfathy99/exciting-news-my-first-cve-discovery-cve-2023-37543-idor-vulnerability-in-cacti-bbb6c386afed · Exploit
• https://security-tracker.debian.org/tracker/CVE-2023-37543 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-37543 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-37543 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-37543 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-37543 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-37543 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-37543 · Security Note
• https://bdu.fstec.ru/vul/2023-06062 · Security Note
• https://github.com/Cacti/cacti/security/advisories/GHSA-4x82-8w8m-w8hj · Note
• https://medium.com/%40hussainfathy99/exciting-news-my-first-cve-discovery-cve-2023-37543-idor-vulnerability-in-cacti-bbb6c386afed · Note
• https://twitter.com/VulmonFeeds/status/1689683414465617940 · Twitter Post
• https://t.me/cvenotify/56197 · Telegram Post