CVE-2019-17358

🗓️ 12 Dec 2019 13:53:51Reported by mitreType

cve🔗 web.nvd.nist.gov👁 225 Views🌐 WEB

Cacti 1.2.7 multiple unsafe deserialization vulnerabilitie

Reporter	Title	Published	Views	Family All 70
AlpineLinux	CVE-2019-17358	12 Dec 201913:53	–	alpinelinux
BDU FSTEC	Cacti lib/functions.php Component Data Compromise	4 Mar 202000:00	–	bdu_fstec
Circl	CVE-2019-17358	11 Mar 202408:11	–	circl
CNVD	Cacti PHP Module Memory Corruption Vulnerability	18 Dec 201900:00	–	cnvd
Cvelist	CVE-2019-17358	12 Dec 201913:53	–	cvelist
Debian	[SECURITY] [DLA 2032-1] cacti security update	11 Dec 201911:51	–	debian
Debian	[SECURITY] [DSA 4604-1] cacti security update	19 Jan 202021:49	–	debian
Debian CVE	CVE-2019-17358	12 Dec 201913:53	–	debiancve
Tenable Nessus	Debian DLA-2032-1 : cacti security update	12 Dec 201900:00	–	nessus
Tenable Nessus	Debian DSA-4604-1 : cacti - security update	21 Jan 202000:00	–	nessus

NVD

Node

cacti cactiRange≤1.2.7

Node

Node

Source	Link
github	www.github.com/Cacti/cacti/issues/3026
lists	www.lists.opensuse.org/opensuse-security-announce/2020-04/msg00048.html
debian	www.debian.org/security/2020/dsa-4604
github	www.github.com/Cacti/cacti/blob/79f29cddb5eb05cbaff486cd634285ef1fed9326/lib/functions.php
people	www.people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-17358.html
darkmatter	www.darkmatter.ae/xen1thlabs/
lists	www.lists.debian.org/debian-lts-announce/2019/12/msg00014.html
bugzilla	www.bugzilla.suse.com/show_bug.cgi
lists	www.lists.opensuse.org/opensuse-security-announce/2020-03/msg00005.html
lists	www.lists.opensuse.org/opensuse-security-announce/2020-04/msg00042.html

Parameter	Position	Path	Description	CWE
user-controlled data	request body	/lib/functions.php	Unsafe deserialization of user-controlled data in lib/functions.php allows an authenticated attacker to influence object data values and potentially cause memory corruption.	CWE-502, CWE-787

17 Jun 2026 02:23Current

8High risk

Vulners AI Score8

CVSS 25.5

CVSS 3.18.1

EPSS0.03033