CVE-2019-17357
Fixed in a distro release EPSS 34%
Cacti through 1.2.7 is affected by a graphs.php?template_id= SQL injection vulnerability affecting how template identifiers are handled when a string and id composite value are used to identify the template type and id. An authenticated attacker can exploit this to extract data from the database, or an unauthenticated remote attacker could exploit this via Cross-Site Request Forgery.
Products: cacti
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | cacti | 1.2.8+ds1-1 |
| Debian 13 | cacti | 1.2.8+ds1-1 |
| Debian 14 | cacti | 1.2.8+ds1-1 |
| SUSE Package Hub 12 | cacti | 1.2.11-5.1 |
| SUSE Package Hub 12 | cacti-spine | 1.2.11-2.1 |
| SUSE Package Hub 15 SP1 | cacti | 1.2.9-bp151.4.3.1 |
| SUSE Package Hub 15 SP1 | cacti | 1.2.11-bp151.4.6.1 |
| SUSE Package Hub 15 SP1 | cacti-spine | 1.2.11-bp151.4.6.1 |
| SUSE Package Hub 15 SP1 | cacti-spine | 1.2.9-bp151.4.3.1 |
| Ubuntu Pro 14.04 LTS | cacti | no fix |
| Ubuntu Pro 16.04 LTS | cacti | no fix |
| Ubuntu Pro 18.04 LTS | cacti | no fix |
| openSUSE Leap 15.1 | cacti | 1.2.11-5.1 |
| openSUSE Leap 15.1 | cacti | 1.2.9-lp151.3.3.1 |
| openSUSE Leap 15.1 | cacti-spine | 1.2.9-lp151.3.3.1 |
| openSUSE Leap 15.1 | cacti-spine | 1.2.11-2.1 |
| openSUSE Tumbleweed | cacti | 1.2.18-1.2 |