CVE-2023-49085
Fixed in a distro release EPSS 74%CVSS 8.8
Cacti provides an operational monitoring and fault management framework. In versions 1.2.25 and prior, it is possible to execute arbitrary SQL code through the `pollers.php` script. An authorized user may be able to execute arbitrary SQL code. The vulnerable component is the `pollers.php`. Impact of the vulnerability - arbitrary SQL code execution. As of time of publication, a patch does not appear to exist.
Products: cacti
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 10 | cacti | 1.2.2+ds1-2+deb10u6 |
| Debian 11 | cacti | 1.2.16+ds1-2+deb11u3 |
| Debian 12 | cacti | 1.2.24+ds1-1+deb12u2 |
| Debian 13 | cacti | 1.2.26+ds1-1 |
| Debian 14 | cacti | 1.2.26+ds1-1 |
| SUSE Package Hub 12 | cacti | 1.2.26-bp155.2.6.1 |
| SUSE Package Hub 12 | cacti-spine | 1.2.26-bp155.2.6.1 |
| SUSE Package Hub 15 SP5 | cacti | 1.2.26-bp155.2.6.1 |
| SUSE Package Hub 15 SP5 | cacti-spine | 1.2.26-bp155.2.6.1 |
| Ubuntu Pro 14.04 LTS | cacti | no fix |
| Ubuntu Pro 16.04 LTS | cacti | no fix |
| Ubuntu Pro 18.04 LTS | cacti | no fix |
| Ubuntu Pro 20.04 LTS | cacti | no fix |
| Ubuntu Pro 22.04 LTS | cacti | no fix |
| openSUSE Leap 15.5 | cacti | 1.2.26-bp155.2.6.1 |
| openSUSE Leap 15.5 | cacti-spine | 1.2.26-bp155.2.6.1 |
| openSUSE Tumbleweed | cacti | 1.2.26-1.1 |