CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 3CVE-2023-49088 – Cacti has incomplete fix for CVE-2023-39515
https://notcve.org/view.php?id=CVE-2023-49088
22 Dec 2023 — Cacti is an open source operational monitoring and fault management framework. The fix applied for CVE-2023-39515 in version 1.2.25 is incomplete as it enables an adversary to have a victim browser execute malicious code when a victim user hovers their mouse over the malicious data source path in `data_debug.php`. To perform the cross-site scripting attack, the adversary needs to be an authorized cacti user with the following permissions: `General Administration>Sites/Devices/Data`. The victim of this attac... • https://github.com/Cacti/cacti/blob/5f6f65c215d663a775950b2d9db35edbaf07d680/data_debug.php • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 3CVE-2023-49085 – Cacti SQL Injection vulnerability
https://notcve.org/view.php?id=CVE-2023-49085
22 Dec 2023 — Cacti provides an operational monitoring and fault management framework. In versions 1.2.25 and prior, it is possible to execute arbitrary SQL code through the `pollers.php` script. An authorized user may be able to execute arbitrary SQL code. The vulnerable component is the `pollers.php`. Impact of the vulnerability - arbitrary SQL code execution. • https://packetstorm.news/files/id/176995 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 1CVE-2023-39511 – Stored Cross-Site-Scripting on reports_admin.php device name in Cacti
https://notcve.org/view.php?id=CVE-2023-39511
06 Sep 2023 — Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting (XSS) Vulnerability which allows an authenticated user to poison data stored in the _cacti_'s database. These data will be viewed by administrative _cacti_ accounts and execute JavaScript code in the victim's browser at view-time. The script under `reports_admin.php` displays reporting information about graphs, devices, data sources etc. _CENSUS_ found that an adversa... • https://github.com/Cacti/cacti/security/advisories/GHSA-5hpr-4hhc-8q42 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 20%CPEs: 3EXPL: 2CVE-2023-30534 – Insecure Deserialization in Cacti
https://notcve.org/view.php?id=CVE-2023-30534
05 Sep 2023 — Cacti is an open source operational monitoring and fault management framework. There are two instances of insecure deserialization in Cacti version 1.2.24. While a viable gadget chain exists in Cacti’s vendor directory (phpseclib), the necessary gadgets are not included, making them inaccessible and the insecure deserializations not exploitable. Each instance of insecure deserialization is due to using the unserialize function without sanitizing the user input. Cacti has a “safe” deserialization that attemp... • https://github.com/Cacti/cacti/security/advisories/GHSA-77rf-774j-6h3p • CWE-502: Deserialization of Untrusted Data •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 1CVE-2023-31132 – Cacti Privilege Escalation
https://notcve.org/view.php?id=CVE-2023-31132
05 Sep 2023 — Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a privilege escalation vulnerability. A low-privileged OS user with access to a Windows host where Cacti is installed can create arbitrary PHP files in a web document directory. The user can then execute the PHP files under the security context of SYSTEM. This allows an attacker to escalate privilege from a normal user account to SYSTEM. • https://github.com/Cacti/cacti/security/advisories/GHSA-rf5w-pq3f-9876 • CWE-306: Missing Authentication for Critical Function •
CVSS: 8.3EPSS: 16%CPEs: 3EXPL: 6CVE-2023-39362 – Authenticated command injection in SNMP options of a Device
https://notcve.org/view.php?id=CVE-2023-39362
05 Sep 2023 — Cacti is an open source operational monitoring and fault management framework. In Cacti 1.2.24, under certain conditions, an authenticated privileged user, can use a malicious string in the SNMP options of a Device, performing command injection and obtaining remote code execution on the underlying server. The `lib/snmp.php` file has a set of functions, with similar behavior, that accept in input some variables and place them into an `exec` call without a proper escape or validation. This issue has been addr... • https://packetstorm.news/files/id/175029 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 1CVE-2023-39516 – Stored Cross-Site-Scripting on data_sources.php debug html-block in Cacti
https://notcve.org/view.php?id=CVE-2023-39516
05 Sep 2023 — Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting (XSS) Vulnerability which allows an authenticated user to poison data stored in the _cacti_'s database. These data will be viewed by administrative _cacti_ accounts and execute JavaScript code in the victim's browser at view-time. The script under `data_sources.php` displays the data source management information (e.g. data source path, polling configuration etc.) for... • https://github.com/Cacti/cacti/security/advisories/GHSA-r8qq-88g3-hmgv • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 1CVE-2023-39365 – Unchecked regular expressions can lead to SQL Injection and data leakage in Cacti
https://notcve.org/view.php?id=CVE-2023-39365
05 Sep 2023 — Cacti is an open source operational monitoring and fault management framework. Issues with Cacti Regular Expression validation combined with the external links feature can lead to limited SQL Injections and subsequent data leakage. This issue has been addressed in version 1.2.25. Users are advised to upgrade. There are no known workarounds for this vulnerability. • https://github.com/Cacti/cacti/security/advisories/GHSA-v5w7-hww7-2f22 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.0EPSS: 0%CPEs: 3EXPL: 1CVE-2023-39358 – Authenticated SQL injection vulnerability in reports_user.php in Cacti
https://notcve.org/view.php?id=CVE-2023-39358
05 Sep 2023 — Cacti is an open source operational monitoring and fault management framework. An authenticated SQL injection vulnerability was discovered which allows authenticated users to perform privilege escalation and remote code execution. The vulnerability resides in the `reports_user.php` file. In `ajax_get_branches`, the `tree_id` parameter is passed to the `reports_get_branch_select` function without any validation. This issue has been addressed in version 1.2.25. • https://github.com/Cacti/cacti/security/advisories/GHSA-gj95-7xr8-9p7g • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.0EPSS: 0%CPEs: 3EXPL: 1CVE-2023-39359 – Authenticated SQL injection vulnerability in graphs.php in Cacti
https://notcve.org/view.php?id=CVE-2023-39359
05 Sep 2023 — Cacti is an open source operational monitoring and fault management framework. An authenticated SQL injection vulnerability was discovered which allows authenticated users to perform privilege escalation and remote code execution. The vulnerability resides in the `graphs.php` file. When dealing with the cases of ajax_hosts and ajax_hosts_noany, if the `site_id` parameter is greater than 0, it is directly reflected in the WHERE clause of the SQL statement. This creates an SQL injection vulnerability. • https://github.com/Cacti/cacti/security/advisories/GHSA-q4wh-3f9w-836h • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •