CVE-2024-54146: Cacti has a SQL Injection vulnerability when view host template
Cacti is an open source performance and fault management framework. Cacti has a SQL injection vulnerability in the template function of hosttemplates.php using the graphtemplate parameter. This vulnerability is fixed in 1.2.29.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/cactito a version that resolves this vulnerability.Fixed in 1.2.28+ds1-4 - Upgrade
Upgrade
debian/cactito a version that resolves this vulnerability.Fixed in 1.2.24+ds1-1+deb12u5Fixed in 1.2.30+ds1-1Fixed in 1.2.31+ds1-4 - Upgrade
Upgrade
Cactito a version that resolves this vulnerability.Fixed in 1.2.29
Event History
Frequently Asked Questions
What is the severity of CVE-2024-54146?
The severity of CVE-2024-54146 is high due to its potential for exploitation via SQL injection.
How do I fix CVE-2024-54146?
To fix CVE-2024-54146, upgrade to Cacti version 1.2.29 or later.
What systems are affected by CVE-2024-54146?
CVE-2024-54146 affects Cacti versions prior to 1.2.29.
What type of vulnerability is CVE-2024-54146?
CVE-2024-54146 is classified as a SQL injection vulnerability.
What component of Cacti is impacted by CVE-2024-54146?
CVE-2024-54146 impacts the template function in the host_templates.php using the graph_template parameter.