CVE-2019-17357: SQL Injection
Cacti through 1.2.7 is affected by a graphs.php?templateid= SQL injection vulnerability affecting how template identifiers are handled when a string and id composite value are used to identify the template type and id. An authenticated attacker can exploit this to extract data from the database, or an unauthenticated remote attacker could exploit this via Cross-Site Request Forgery.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2019-17357?
CVE-2019-17357 is a SQL injection vulnerability in Cacti through 1.2.7 that allows an authenticated attacker to extract data from the database.
What is the severity of CVE-2019-17357?
CVE-2019-17357 has a severity rating of 6.5 (High).
How does CVE-2019-17357 affect Cacti?
CVE-2019-17357 affects Cacti versions 1.2.2+ds1-2+deb10u4, 1.2.2+ds1-2+deb10u5, 1.2.16+ds1-2+deb11u1, 1.2.24+ds1-1, and 1.2.25+ds1-2.
How can an attacker exploit CVE-2019-17357?
An authenticated attacker can exploit CVE-2019-17357 by using a specially crafted URL to perform SQL injection and extract data from the database.
Is there a fix for CVE-2019-17357?
Yes, the fix for CVE-2019-17357 is to upgrade to a patched version of Cacti, such as 1.2.2+ds1-2+deb10u6 or 1.2.7+ds1-1.