Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
cve[email protected]CVE-2023-49085
HistoryDec 22, 2023 - 5:15 p.m.

CVE-2023-49085

2023-12-2217:15:07
CWE-89
[email protected]
web.nvd.nist.gov
16
cacti
operational monitoring
fault management
cve-2023-49085
sql injection
patch missing

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.8 High

AI Score

Confidence

Low

6.5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

0.001 Low

EPSS

Percentile

45.8%

JSON

Cacti provides an operational monitoring and fault management framework. In versions 1.2.25 and prior, it is possible to execute arbitrary SQL code through the pollers.php script. An authorized user may be able to execute arbitrary SQL code. The vulnerable component is the pollers.php. Impact of the vulnerability - arbitrary SQL code execution. As of time of publication, a patch does not appear to exist.

VendorProductVersionCPE
cacticacti*cpe:2.3:a:cacti:cacti:*:*:*:*:*:*:*:*

Related

osv 3
cvelist 1
debiancve 1
veracode 1
ubuntucve 1
alpinelinux 1
prion 1
metasploit 1
packetstorm 1
zdt 1
rapid7blog 1
openvas 3
nessus 3
debian 2
osv
osv
CVE-2023-49085
2023-12-22 17:15:07
cacti - security update
2024-03-24 00:00:00
cacti - security update
2024-03-18 00:00:00
cvelist
cvelist
CVE-2023-49085 Cacti SQL Injection vulnerability
2023-12-22 16:13:13
debiancve
debiancve
CVE-2023-49085
2023-12-22 17:15:07
veracode
veracode
SQL Injection
2023-12-28 08:43:06
ubuntucve
ubuntucve
CVE-2023-49085
2023-12-22 00:00:00
alpinelinux
alpinelinux
CVE-2023-49085
2023-12-22 17:15:07
prion
prion
Design/Logic Flaw
2023-12-22 17:15:00
metasploit
metasploit
Cacti RCE via SQLi in pollers.php
2024-01-30 11:52:02
packetstorm
packetstorm
Cacti pollers.php SQL Injection / Remote Code Execution
2024-02-05 00:00:00
zdt
zdt
Cacti pollers.php SQL Injection / Remote Code Execution Exploit
2024-02-05 00:00:00
rapid7blog
rapid7blog
Metasploit Weekly Wrap-Up 02/09/2024
2024-02-09 19:35:23
openvas
openvas
openSUSE: Security Advisory for cacti, cacti (openSUSE-SU-2024:0031-1)
2024-03-04 00:00:00
Debian: Security Advisory (DSA-5646-1)
2024-03-25 00:00:00
Debian: Security Advisory (DLA-3765-1)
2024-03-19 00:00:00
nessus
nessus
openSUSE 15 Security Update : cacti, cacti-spine (openSUSE-SU-2024:0031-1)
2024-01-25 00:00:00
Debian dsa-5646 : cacti - security update
2024-03-24 00:00:00
Debian dla-3765 : cacti - security update
2024-03-18 00:00:00
debian
debian
[SECURITY] [DSA 5646-1] cacti security update
2024-03-24 13:02:20
[SECURITY] [DLA 3765-1] cacti security update
2024-03-18 18:41:54

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.8 High

AI Score

Confidence

Low

6.5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

0.001 Low

EPSS

Percentile

45.8%

JSON
Related for CVE-2023-49085
osv3cvelist1debiancve1veracode1ubuntucve1alpinelinux1prion1metasploit1packetstorm1zdt1rapid7blog1openvas3nessus3debian2