CVE-2019-17357: SQL Injection
First published: Wed Dec 25 2019(Updated: )
Cacti through 1.2.7 is affected by a graphs.php?template_id= SQL injection vulnerability affecting how template identifiers are handled when a string and id composite value are used to identify the template type and id. An authenticated attacker can exploit this to extract data from the database, or an unauthenticated remote attacker could exploit this via Cross-Site Request Forgery.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cacti Cacti | <=1.2.7 | |
| debian/cacti | 1.2.2+ds1-2+deb10u4 1.2.2+ds1-2+deb10u5 1.2.16+ds1-2+deb11u1 1.2.16+ds1-2+deb11u2 1.2.24+ds1-1+deb12u1 1.2.25+ds1-2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/Cacti/cacti/issues/3025
- https://security-tracker.debian.org/tracker/CVE-2019-17357
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17357
- https://github.com/Cacti/cacti/commit/d6dc48503bbcde0717e7a93df7638fd4796200f4
- https://security-tracker.debian.org/tracker/CVE-2019-17358
- https://security-tracker.debian.org/tracker/CVE-2019-16723
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=947374
- http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00001.html
- http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00005.html
- http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00042.html
- http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00048.html
- https://security.gentoo.org/glsa/202003-40
- https://www.darkmatter.ae/xen1thlabs/
Frequently Asked Questions
What is CVE-2019-17357?
CVE-2019-17357 is a SQL injection vulnerability in Cacti through 1.2.7 that allows an authenticated attacker to extract data from the database.
What is the severity of CVE-2019-17357?
CVE-2019-17357 has a severity rating of 6.5 (High).
How does CVE-2019-17357 affect Cacti?
CVE-2019-17357 affects Cacti versions 1.2.2+ds1-2+deb10u4, 1.2.2+ds1-2+deb10u5, 1.2.16+ds1-2+deb11u1, 1.2.24+ds1-1, and 1.2.25+ds1-2.
How can an attacker exploit CVE-2019-17357?
An authenticated attacker can exploit CVE-2019-17357 by using a specially crafted URL to perform SQL injection and extract data from the database.
Is there a fix for CVE-2019-17357?
Yes, the fix for CVE-2019-17357 is to upgrade to a patched version of Cacti, such as 1.2.2+ds1-2+deb10u6 or 1.2.7+ds1-1.
- collector/debian-bugs
- alias/CVE-2019-17357
- collector/nvd-index
- collector/security-tracker-debian
- vendor/cacti
- canonical/cacti cacti
- version/cacti cacti/1.2.7
- package-manager/debian