CVE-2023-49084: Local File Inclusion (RCE) in Cacti
Cacti is a robust performance and fault management framework and a frontend to RRDTool - a Time Series Database (TSDB). While using the detected SQL Injection and insufficient processing of the include file path, it is possible to execute arbitrary code on the server. Exploitation of the vulnerability is possible for an authorized user. The vulnerable component is the link.php. Impact of the vulnerability execution of arbitrary code on the server.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-49084?
CVE-2023-49084 is rated as critical due to the potential for remote code execution via SQL injection.
How do I fix CVE-2023-49084?
To mitigate CVE-2023-49084, upgrade to the latest version of Cacti that addresses this vulnerability.
What are the affected versions for CVE-2023-49084?
CVE-2023-49084 specifically affects Cacti version 1.2.25.
Can CVE-2023-49084 lead to data breaches?
Yes, CVE-2023-49084 can potentially lead to unauthorized access to sensitive data through code execution.
Is it safe to use Cacti version 1.2.25 after the discovery of CVE-2023-49084?
No, it is not safe to use Cacti version 1.2.25 until the vulnerability CVE-2023-49084 has been patched.