CVE-2019-17357

Description

Cacti through 1.2.7 is affected by a graphs.phptemplate_id= SQL injection vulnerability affecting how template identifiers are handled when a string and id composite value are used to identify the template type and id. An authenticated attacker can exploit this to extract data from the database, or an unauthenticated remote attacker could exploit this via Cross-Site Request Forgery.

Risk Information

Base Score

6.5

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS Score

Exploitation Probability

16.157

Associated Vulnerability

Vulnerability	OS Platform
cacti security update(DSA-4604-1) cacti_1.2.2+ds1-2+deb10u2_all.deb	Linux
cacti security update(DSA-4604-1) cacti_0.8.8h+ds1-10+deb9u1_all.deb	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234