CVE-2023-39357

NameCVE-2023-39357
DescriptionCacti is an open source operational monitoring and fault management framework. A defect in the sql_save function was discovered. When the column type is numeric, the sql_save function directly utilizes user input. Many files and functions calling the sql_save function do not perform prior validation of user input, leading to the existence of multiple SQL injection vulnerabilities in Cacti. This allows authenticated users to exploit these SQL injection vulnerabilities to perform privilege escalation and remote code execution. This issue has been addressed in version 1.2.25. Users are advised to upgrade. There are no known workarounds for this vulnerability.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDSA-5550-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
cacti (PTS)buster1.2.2+ds1-2+deb10u4vulnerable
buster (security)1.2.2+ds1-2+deb10u5vulnerable
bullseye1.2.16+ds1-2+deb11u1vulnerable
bullseye (security)1.2.16+ds1-2+deb11u2fixed
bookworm1.2.24+ds1-1vulnerable
bookworm (security)1.2.24+ds1-1+deb12u1fixed
sid, trixie1.2.25+ds1-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
cactisourcebullseye1.2.16+ds1-2+deb11u2DSA-5550-1
cactisourcebookworm1.2.24+ds1-1+deb12u1DSA-5550-1
cactisource(unstable)1.2.25+ds1-1

Notes

https://github.com/Cacti/cacti/security/advisories/GHSA-6jhp-mgqg-fhqg
https://github.com/cacti/cacti/commit/21f6b5c9238b3e8c83f2c9295374d96eb104f21d

Search for package or bug name: Reporting problems