CVE-2024-45598: Cacti has a Local File Inclusion (LFI) Vulnerability via Poller Standard Error Log Path
Cacti is an open source performance and fault management framework. Prior to 1.2.29, an administrator can change the Poller Standard Error Log Path parameter in either Installation Step 5 or in Configuration->Settings->Paths tab to a local file inside the server. Then simply going to Logs tab and selecting the name of the local file will show its content on the web UI. This vulnerability is fixed in 1.2.29.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/cactito a version that resolves this vulnerability.Fixed in 1.2.24+ds1-1+deb12u5 - Upgrade
Upgrade
debian/cactito a version that resolves this vulnerability.Fixed in 1.2.28+ds1-4 - Upgrade
Upgrade
debian/cactito a version that resolves this vulnerability.Fixed in 1.2.24+ds1-1+deb12u5Fixed in 1.2.30+ds1-1Fixed in 1.2.31+ds1-4 - Upgrade
Upgrade
alpine/cactito a version that resolves this vulnerability.Fixed in 1.2.29-r0 - Upgrade
Upgrade
Cactito a version that resolves this vulnerability.Fixed in 1.2.29
Event History
Frequently Asked Questions
What is the severity of CVE-2024-45598?
CVE-2024-45598 has a high severity level due to the potential for unauthorized file access.
How do I fix CVE-2024-45598?
To fix CVE-2024-45598, upgrade to Cacti version 1.2.29 or later.
What does CVE-2024-45598 affect?
CVE-2024-45598 affects versions of Cacti prior to 1.2.29.
What is the nature of the vulnerability in CVE-2024-45598?
CVE-2024-45598 allows an administrator to improperly set the Poller Standard Error Log Path to a local file, potentially exposing sensitive data.
Is Cacti still safe to use after CVE-2024-45598?
Cacti remains safe to use as long as it is updated to the patched version 1.2.29 or higher.