CVE-2023-39361

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-39361
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-39361.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2023-39361
Aliases
  • GHSA-6r43-q2fw-5wrg
Downstream
Related
Published
2023-09-05T20:58:00.188Z
Modified
2026-07-11T03:54:00.388727574Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Unauthenticated SQL Injection in graph_view.php in Cacti
Details

Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a SQL injection discovered in graphview.php. Since guest users can access graphview.php without authentication by default, if guest users are being utilized in an enabled state, there could be the potential for significant damage. Attackers may exploit this vulnerability, and there may be possibilities for actions such as the usurpation of administrative privileges or remote code execution. This issue has been addressed in version 1.2.25. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Database specific 
{
    "cwe_ids": [
        "CWE-89"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/39xxx/CVE-2023-39361.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/cacti/cacti

Affected ranges

Type
GIT
Repo
https://github.com/cacti/cacti
Events
Introduced
9e55ba79729142315110702db8aa8268ce5ea102
Fixed
18500fa313a9f1ee1be48aa111c0eeea001010fa
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.2.25"
        },
        {
            "introduced": "1.2.24"
        },
        {
            "last_affected": "1.2.24"
        }
    ],
    "cpe": "cpe:2.3:a:cacti:cacti:1.2.24:*:*:*:*:*:*:*",
    "source": [
        "AFFECTED_FIELD",
        "CPE_STRING"
    ]
}

Affected versions

1.*
1.2.24
release/1.*
release/1.2.24

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-39361.json"