ZDI-CAN-21001: ZDI-23-1499: Cacti link Local File Inclusion Remote Code Execution Vulnerability

Published Oct 4, 2023

Updated

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Cacti. Authentication is required to exploit this vulnerability. The specific flaw exists within the link endpoint. The issue results from the lack of proper validation of data retrieved from the database prior to passing it to a PHP include function. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the service account.

Other sources

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Cacti. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.6. The following CVEs are assigned: CVE-2023-39365.

Affected Software

1 affected component

Cacti Cacti

Event History

Oct 4, 2023

Advisory Published

05:00 AM

Data Sourced

05:00 AM

Description

Jan 29, 2025

Advisory Published

06:51 AM

Frequently Asked Questions

What is ZDI-CAN-21001 vulnerability?

ZDI-CAN-21001 is a vulnerability in Cacti that allows remote attackers to execute arbitrary code on affected installations of Cacti.

How severe is the ZDI-CAN-21001 vulnerability?

The severity of the ZDI-CAN-21001 vulnerability is medium with a CVSSv3 score of 6.6.

What software is affected by the ZDI-CAN-21001 vulnerability?

The ZDI-CAN-21001 vulnerability affects installations of Cacti.

Is authentication required to exploit the ZDI-CAN-21001 vulnerability?

Yes, authentication is required to exploit the ZDI-CAN-21001 vulnerability.

How can I fix the ZDI-CAN-21001 vulnerability?

To fix the ZDI-CAN-21001 vulnerability, it is recommended to update to the latest version of Cacti.