CVE-2023-51448
Fixed in a distro release EPSS 67%CVSS 8.8
Cacti provides an operational monitoring and fault management framework. Version 1.2.25 has a Blind SQL Injection (SQLi) vulnerability within the SNMP Notification Receivers feature in the file `‘managers.php’`. An authenticated attacker with the “Settings/Utilities” permission can send a crafted HTTP GET request to the endpoint `‘/cacti/managers.php’` with an SQLi payload in the `‘selected_graphs_array’` HTTP GET parameter. As of time of publication, no patched versions exist.
Products: cacti
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 13 | cacti | 1.2.26+ds1-1 |
| Debian 14 | cacti | 1.2.26+ds1-1 |
| SUSE Package Hub 12 | cacti | 1.2.26-bp155.2.6.1 |
| SUSE Package Hub 12 | cacti-spine | 1.2.26-bp155.2.6.1 |
| SUSE Package Hub 15 SP5 | cacti | 1.2.26-bp155.2.6.1 |
| SUSE Package Hub 15 SP5 | cacti-spine | 1.2.26-bp155.2.6.1 |
| Ubuntu Pro 14.04 LTS | cacti | no fix |
| Ubuntu Pro 16.04 LTS | cacti | no fix |
| Ubuntu Pro 18.04 LTS | cacti | no fix |
| Ubuntu Pro 20.04 LTS | cacti | no fix |
| Ubuntu Pro 22.04 LTS | cacti | no fix |
| openSUSE Leap 15.5 | cacti | 1.2.26-bp155.2.6.1 |
| openSUSE Leap 15.5 | cacti-spine | 1.2.26-bp155.2.6.1 |
| openSUSE Tumbleweed | cacti | 1.2.26-1.1 |