CVE-2019-17358: High severity Cacti Cacti vulnerability
Cacti through 1.2.7 is affected by multiple instances of lib/functions.php unsafe deserialization of user-controlled data to populate arrays. An authenticated attacker could use this to influence object data values and control actions taken by Cacti or potentially cause memory corruption in the PHP module.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/cactito a version that resolves this vulnerability.Fixed in 1.2.16+ds1-2+deb11u3Fixed in 1.2.16+ds1-2+deb11u5Fixed in 1.2.24+ds1-1+deb12u5Fixed in 1.2.30+ds1-1 - Upgrade
Upgrade
alpine/cactito a version that resolves this vulnerability.Fixed in 1.2.8-r0
Event History
Frequently Asked Questions
What is CVE-2019-17358?
CVE-2019-17358 is a vulnerability in Cacti through 1.2.7 that allows an authenticated attacker to influence object data values and control actions taken by Cacti or potentially cause memory corruption in PHP.
How does CVE-2019-17358 affect Cacti?
CVE-2019-17358 affects Cacti versions up to and including 1.2.7.
What is the severity of CVE-2019-17358?
CVE-2019-17358 has a severity rating of 8.1 (high).
How can an attacker exploit CVE-2019-17358?
An authenticated attacker can exploit CVE-2019-17358 by using unsafe deserialization of user-controlled data to populate arrays in the lib/functions.php file.
Is there a fix for CVE-2019-17358?
Yes, the fix for CVE-2019-17358 is to upgrade to Cacti version 1.2.8+ or apply the recommended patches for specific distributions.