CVE-2019-16723
Fixed in a distro release EPSS 1%
In Cacti through 1.2.6, authenticated users may bypass authorization checks (for viewing a graph) via a direct graph_json.php request with a modified local_graph_id parameter.
Products: cacti
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | cacti | 1.2.7+ds1-1 |
| Debian 13 | cacti | 1.2.7+ds1-1 |
| Debian 14 | cacti | 1.2.7+ds1-1 |
| SUSE Package Hub 12 | cacti | 1.2.11-5.1 |
| SUSE Package Hub 12 | cacti-spine | 1.2.11-2.1 |
| SUSE Package Hub 15 SP1 | cacti | 1.2.11-bp151.4.6.1 |
| SUSE Package Hub 15 SP1 | cacti | 1.2.9-bp151.4.3.1 |
| SUSE Package Hub 15 SP1 | cacti-spine | 1.2.11-bp151.4.6.1 |
| SUSE Package Hub 15 SP1 | cacti-spine | 1.2.9-bp151.4.3.1 |
| Ubuntu Pro 14.04 LTS | cacti | no fix |
| Ubuntu Pro 18.04 LTS | cacti | no fix |
| openSUSE Leap 15.1 | cacti | 1.2.11-5.1 |
| openSUSE Leap 15.1 | cacti | 1.2.9-lp151.3.3.1 |
| openSUSE Leap 15.1 | cacti-spine | 1.2.9-lp151.3.3.1 |
| openSUSE Leap 15.1 | cacti-spine | 1.2.11-2.1 |
| openSUSE Tumbleweed | cacti | 1.2.18-1.2 |