CVE-2023-30534: Insecure Deserialization in Cacti
First published: Tue Sep 05 2023(Updated: )
Cacti is an open source operational monitoring and fault management framework. There are two instances of insecure deserialization in Cacti version 1.2.24. While a viable gadget chain exists in Cacti’s vendor directory (phpseclib), the necessary gadgets are not included, making them inaccessible and the insecure deserializations not exploitable. Each instance of insecure deserialization is due to using the unserialize function without sanitizing the user input. Cacti has a “safe” deserialization that attempts to sanitize the content and check for specific values before calling unserialize, but it isn’t used in these instances. The vulnerable code lies in graphs_new.php, specifically within the host_new_graphs_save function. This issue has been addressed in version 1.2.25. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Credit: security-advisories@github.com security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cacti Cacti | <1.2.25 | |
| Fedoraproject Fedora | =37 | |
| Fedoraproject Fedora | =38 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/Cacti/cacti/security/advisories/GHSA-77rf-774j-6h3p
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CFH3J2WVBKY4ZJNMARVOWJQK6PSLPHFH/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WZGB2UXJEUYWWA6IWVFQ3ZTP22FIHMGN/
- https://www.fastly.com/blog/cve-2023-30534-insecure-deserialization-in-cacti-prior-to-1-2-25
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WOQFYGLZBAWT4AWNMO7DU73QXWPXTCKH/
Frequently Asked Questions
What is CVE-2023-30534?
CVE-2023-30534 is a vulnerability found in Cacti version 1.2.24, an open source operational monitoring and fault management framework.
What is the severity of CVE-2023-30534?
CVE-2023-30534 has a severity rating of medium with a severity value of 4.3.
How does CVE-2023-30534 affect Cacti?
CVE-2023-30534 affects Cacti version 1.2.24 and prior.
What is the Common Weakness Enumeration (CWE) of CVE-2023-30534?
CVE-2023-30534 is associated with Common Weakness Enumeration (CWE) 502.
How can I fix CVE-2023-30534?
To fix CVE-2023-30534, it is recommended to update Cacti to version 1.2.25 or later.
- collector/nvd-api
- collector/nvd-index
- agent/references
- agent/severity
- agent/author
- agent/type
- agent/event
- agent/title
- agent/weakness
- agent/softwarecombine
- agent/first-publish-date
- agent/last-modified-date
- agent/description
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/cacti
- canonical/cacti cacti
- vendor/fedoraproject
- canonical/fedoraproject fedora
- version/fedoraproject fedora/37
- version/fedoraproject fedora/38