CVE-2023-49084: Local File Inclusion (RCE) in Cacti
First published: Thu Dec 21 2023(Updated: )
Cacti is a robust performance and fault management framework and a frontend to RRDTool - a Time Series Database (TSDB). While using the detected SQL Injection and insufficient processing of the include file path, it is possible to execute arbitrary code on the server. Exploitation of the vulnerability is possible for an authorized user. The vulnerable component is the `link.php`. Impact of the vulnerability execution of arbitrary code on the server.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cacti | =1.2.25 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://packetstormsecurity.com/files/176995/Cacti-pollers.php-SQL-Injection-Remote-Code-Execution.html
- https://github.com/Cacti/cacti/security/advisories/GHSA-pfh9-gwm6-86vp
- https://lists.debian.org/debian-lts-announce/2024/03/msg00018.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RBEOAFKRARQHTDIYSL723XAFJ2Q6624X/
Frequently Asked Questions
What is the severity of CVE-2023-49084?
CVE-2023-49084 is rated as critical due to the potential for remote code execution via SQL injection.
How do I fix CVE-2023-49084?
To mitigate CVE-2023-49084, upgrade to the latest version of Cacti that addresses this vulnerability.
What are the affected versions for CVE-2023-49084?
CVE-2023-49084 specifically affects Cacti version 1.2.25.
Can CVE-2023-49084 lead to data breaches?
Yes, CVE-2023-49084 can potentially lead to unauthorized access to sensitive data through code execution.
Is it safe to use Cacti version 1.2.25 after the discovery of CVE-2023-49084?
No, it is not safe to use Cacti version 1.2.25 until the vulnerability CVE-2023-49084 has been patched.
- agent/type
- agent/first-publish-date
- agent/severity
- agent/author
- agent/title
- agent/weakness
- agent/description
- agent/softwarecombine
- agent/event
- agent/references
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/cacti
- canonical/cacti
- version/cacti/1.2.25