CVE-2024-31458: Cacti SQL Injection vulnerability in lib/html_form_templates.php by reading dirty data stored in database
Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, some of the data stored in formsave() function in graphtemplateinputs.php is not thoroughly checked and is used to concatenate the SQL statement in drawnontemplatedfieldsgraphitem() function from lib/htmlformtemplates.php , finally resulting in SQL injection. Version 1.2.27 contains a patch for the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/cactito a version that resolves this vulnerability.Fixed in 1.2.24+ds1-1+deb12u3 - Upgrade
Upgrade
debian/cactito a version that resolves this vulnerability.Fixed in 1.2.27+ds1-1 - Upgrade
Upgrade
debian/cactito a version that resolves this vulnerability.Fixed in 1.2.24+ds1-1+deb12u5Fixed in 1.2.30+ds1-1Fixed in 1.2.31+ds1-4 - Upgrade
Upgrade
alpine/cactito a version that resolves this vulnerability.Fixed in 1.2.27-r0 - Upgrade
Upgrade
Cactito a version that resolves this vulnerability.Fixed in 1.2.27
Event History
Frequently Asked Questions
What is the severity of CVE-2024-31458?
CVE-2024-31458 has a moderate severity level due to its potential for SQL injection vulnerabilities.
How do I fix CVE-2024-31458?
To mitigate CVE-2024-31458, upgrade to Cacti version 1.2.27 or higher.
What versions are affected by CVE-2024-31458?
CVE-2024-31458 affects Cacti versions prior to 1.2.27, including 1.2.16+ds1-2+deb11u3 and 1.2.24+ds1-1+deb12u2.
What components are vulnerable in CVE-2024-31458?
The vulnerability resides in the `form_save()` function within `graph_template_inputs.php`, where the data lacks proper validation.
Is CVE-2024-31458 specific to certain operating systems?
CVE-2024-31458 affects multiple operating systems including Debian and Fedora systems running vulnerable versions of Cacti.