CVE-2019-17358
Fixed in a distro release EPSS 3%
Cacti through 1.2.7 is affected by multiple instances of lib/functions.php unsafe deserialization of user-controlled data to populate arrays. An authenticated attacker could use this to influence object data values and control actions taken by Cacti or potentially cause memory corruption in the PHP module.
Products: cacti, debian_linux, opensuse leap
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 10 | cacti | 1.2.2+ds1-2+deb10u2 |
| Debian 12 | cacti | 1.2.8+ds1-1 |
| Debian 13 | cacti | 1.2.8+ds1-1 |
| Debian 14 | cacti | 1.2.8+ds1-1 |
| Debian 8 | cacti | 0.8.8b+dfsg-8+deb8u8 |
| Debian 9 | cacti | 0.8.8h+ds1-10+deb9u1 |
| SUSE Package Hub 12 | cacti | 1.2.11-5.1 |
| SUSE Package Hub 12 | cacti-spine | 1.2.11-2.1 |
| SUSE Package Hub 15 SP1 | cacti | 1.2.11-bp151.4.6.1 |
| SUSE Package Hub 15 SP1 | cacti | 1.2.9-bp151.4.3.1 |
| SUSE Package Hub 15 SP1 | cacti-spine | 1.2.9-bp151.4.3.1 |
| SUSE Package Hub 15 SP1 | cacti-spine | 1.2.11-bp151.4.6.1 |
| Ubuntu Pro 14.04 LTS | cacti | 0.8.8b+dfsg-5ubuntu0.2+esm1 |
| Ubuntu Pro 16.04 LTS | cacti | no fix |
| Ubuntu Pro 18.04 LTS | cacti | no fix |
| openSUSE Leap 15.1 | cacti | 1.2.11-5.1 |
| openSUSE Leap 15.1 | cacti | 1.2.9-lp151.3.3.1 |
| openSUSE Leap 15.1 | cacti-spine | 1.2.9-lp151.3.3.1 |
| openSUSE Leap 15.1 | cacti-spine | 1.2.11-2.1 |
| openSUSE Tumbleweed | cacti | 1.2.18-1.2 |