graph.php in Cacti 0.8.7 before 0.8.7b and 0.8.6 before 0.8.6k allows remote attackers to obtain the full path via an invalid local_graph_id parameter and other unspecified vectors.
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
Debian | 12 | all | cacti | < 0.8.7b-1 | cacti_0.8.7b-1_all.deb |
Debian | 11 | all | cacti | < 0.8.7b-1 | cacti_0.8.7b-1_all.deb |
Debian | 10 | all | cacti | < 0.8.7b-1 | cacti_0.8.7b-1_all.deb |
Debian | 999 | all | cacti | < 0.8.7b-1 | cacti_0.8.7b-1_all.deb |
Debian | 13 | all | cacti | < 0.8.7b-1 | cacti_0.8.7b-1_all.deb |