CVE-2023-39365mediumCWE-89

CVE-2023-39365: fallo de gravedad media en cacti

Unchecked regular expressions can lead to SQL Injection and data leakage in Cacti

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear cacti+ Monitorear cacti

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 4.6epss 0.9%
Cacti is an open source operational monitoring and fault management framework. Issues with Cacti Regular Expression validation combined with the external links feature can lead to limited SQL Injections and subsequent data leakage. This issue has been addressed in version 1.2.25. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L
Productos afectados
Cacti · cacti
CVEs relacionadas — cacti

En el mismo producto, de las más peligrosas a las menos.

CVE-2022-46169CRITICALUnauthenticated Command InjectionEPSS 99.8%KEVCVE-2024-29895CRITICALCacti command injection in cmd_realtime.phpEPSS 98.8%CVE-2023-39361CRITICALUnauthenticated SQL Injection in graph_view.php in CactiEPSS 88.8%CVE-2024-25641CRITICALCacti RCE vulnerability when importing packagesEPSS 86.3%CVE-2023-39362HIGHAuthenticated command injection in SNMP options of a DeviceEPSS 85.4%CVE-2023-49085HIGHCacti SQL Injection vulnerabilityEPSS 74.5%