CVE-2023-39358: Authenticated SQL injection vulnerability in reports_user.php in Cacti
First published: Tue Sep 05 2023(Updated: )
Cacti is an open source operational monitoring and fault management framework. An authenticated SQL injection vulnerability was discovered which allows authenticated users to perform privilege escalation and remote code execution. The vulnerability resides in the `reports_user.php` file. In `ajax_get_branches`, the `tree_id` parameter is passed to the `reports_get_branch_select` function without any validation. This issue has been addressed in version 1.2.25. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Credit: security-advisories@github.com security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cacti Cacti | <1.2.25 | |
| Fedoraproject Fedora | =37 | |
| Fedoraproject Fedora | =38 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/Cacti/cacti/security/advisories/GHSA-gj95-7xr8-9p7g
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CFH3J2WVBKY4ZJNMARVOWJQK6PSLPHFH/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WZGB2UXJEUYWWA6IWVFQ3ZTP22FIHMGN/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WOQFYGLZBAWT4AWNMO7DU73QXWPXTCKH/
Frequently Asked Questions
What is CVE-2023-39358 vulnerability?
CVE-2023-39358 is an authenticated SQL injection vulnerability in Cacti, allowing authenticated users to perform privilege escalation and remote code execution.
How does CVE-2023-39358 affect Cacti?
CVE-2023-39358 affects Cacti version 1.2.25. It allows authenticated users to perform privilege escalation and remote code execution.
What is the severity of CVE-2023-39358?
CVE-2023-39358 has a severity rating of 8.8 (high).
How can I fix CVE-2023-39358 vulnerability in Cacti?
To fix CVE-2023-39358 in Cacti, you should update to a version beyond 1.2.25, which is the affected version.
Where can I find more information about CVE-2023-39358?
You can find more information about CVE-2023-39358 on the official GitHub page of Cacti: [link](https://github.com/Cacti/cacti/security/advisories/GHSA-gj95-7xr8-9p7g)
- collector/nvd-api
- collector/nvd-index
- agent/weakness
- agent/title
- agent/references
- agent/severity
- agent/author
- agent/type
- agent/description
- agent/event
- agent/softwarecombine
- agent/first-publish-date
- agent/last-modified-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/cacti
- canonical/cacti cacti
- vendor/fedoraproject
- canonical/fedoraproject fedora
- version/fedoraproject fedora/37
- version/fedoraproject fedora/38