CVE-2023-49085

CVSS V2 None CVSS V3 None
Description
Cacti provides an operational monitoring and fault management framework. In versions 1.2.25 and prior, it is possible to execute arbitrary SQL code through the `pollers.php` script. An authorized user may be able to execute arbitrary SQL code. The vulnerable component is the `pollers.php`. Impact of the vulnerability - arbitrary SQL code execution. As of time of publication, a patch does not appear to exist.
Overview
  • CVE ID
  • CVE-2023-49085
  • Assigner
  • GitHub_M
  • Vulnerability Status
  • PUBLISHED
  • Published Version
  • 2023-12-22T16:13:13.259Z
  • Last Modified Date
  • 2023-12-22T16:13:13.259Z
Weakness Enumerations
CWE URL
CWE-89 http://cwe.mitre.org/data/definitions/89.html
References
Reference URL Reference Tags
https://github.com/Cacti/cacti/security/advisories/GHSA-vr3c-38wh-g855 x_refsource_CONFIRM
https://github.com/Cacti/cacti/blob/5f6f65c215d663a775950b2d9db35edbaf07d680/pollers.php#L451 x_refsource_MISC
http://packetstormsecurity.com/files/176995/Cacti-pollers.php-SQL-Injection-Remote-Code-Execution.html
https://lists.debian.org/debian-lts-announce/2024/03/msg00018.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RBEOAFKRARQHTDIYSL723XAFJ2Q6624X/
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2023-49085
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-49085
History
Created Old Value New Value Data Type Notes
2024-06-25 12:48:17 Added to TrackCVE