CVE-2023-49084highCWE-98

CVE-2023-49084: high-severity vulnerability in cacti

Local File Inclusion (RCE) in Cacti

Published · Updated

Follow this CVE+ Monitor cacti+ Monitor cacti

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

48Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendcvss 8.1epss 64%
from disclosure to weaponsame day
Published on NVDDec 21
metasploitDec 20
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Not affected
1 product — because the vulnerable code is not present in the product
red_hat_products
In short

Cacti, a monitoring tool, has a vulnerability where authorized users can include malicious files and run arbitrary code on the server. This happens because the application doesn't properly check file paths when including files.

Technical detail

CVE-2023-49084 exploits insufficient path validation in Cacti's link.php combined with SQL injection to achieve local file inclusion (LFI) leading to remote code execution. An authenticated attacker can manipulate include file parameters to load and execute arbitrary code on the server. The vulnerability requires valid credentials but allows full system compromise.

Summary generated and translated by AI from the official description.
Cacti is a robust performance and fault management framework and a frontend to RRDTool - a Time Series Database (TSDB). While using the detected SQL Injection and insufficient processing of the include file path, it is possible to execute arbitrary code on the server. Exploitation of the vulnerability is possible for an authorized user. The vulnerable component is the `link.php`. Impact of the vulnerability execution of arbitrary code on the server.
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Affected products
Cacti · cacti
Related CVEs — cacti

In the same product, most dangerous first.

CVE-2022-46169CRITICALUnauthenticated Command InjectionEPSS 99.8%KEVCVE-2024-29895CRITICALCacti command injection in cmd_realtime.phpEPSS 98.8%CVE-2023-39361CRITICALUnauthenticated SQL Injection in graph_view.php in CactiEPSS 88.8%CVE-2024-25641CRITICALCacti RCE vulnerability when importing packagesEPSS 86.3%CVE-2023-39362HIGHAuthenticated command injection in SNMP options of a DeviceEPSS 85.4%CVE-2023-49085HIGHCacti SQL Injection vulnerabilityEPSS 74.5%