CVE-2017-16661

2017-11-0805:29:00

Google

osv.dev

6.4 Medium

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

50.5%

JSON

Cacti 1.1.27 allows remote authenticated administrators to read arbitrary files by placing the Log Path into a private directory, and then making a clog.php?filename= request, as demonstrated by filename=passwd (with a Log Path under /etc) to read /etc/passwd.

CPENameOperatorVersion
cactieqrelease/1.1.20
cactieqrelease/1.1.5
cactieqrelease/1.0.6
cactieqrelease/1.1.25
cactieqrelease/1.0.2
cactieqrelease/1.1.16
cactieqrelease/1.0.0
cactieqrelease/1.1.1
cactieqrelease/1.1.14
cactieqrelease/1.0.4

Name	Operator	Version
cacti	eq	release/1.1.20
cacti	eq	release/1.1.5
cacti	eq	release/1.0.6
cacti	eq	release/1.1.25
cacti	eq	release/1.0.2
cacti	eq	release/1.1.16
cacti	eq	release/1.0.0
cacti	eq	release/1.1.1
cacti	eq	release/1.1.14
cacti	eq	release/1.0.4