CVE-2023-39365

Name	CVE-2023-39365
Description	Cacti is an open source operational monitoring and fault management framework. Issues with Cacti Regular Expression validation combined with the external links feature can lead to limited SQL Injections and subsequent data leakage. This issue has been addressed in version 1.2.25. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
cacti (PTS)	buster	1.2.2+ds1-2+deb10u4	vulnerable
	buster (security)	1.2.2+ds1-2+deb10u5	vulnerable
	bullseye (security), bullseye	1.2.16+ds1-2+deb11u1	vulnerable
	bookworm	1.2.24+ds1-1	vulnerable
	trixie, sid	1.2.25+ds1-2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
cacti	source	(unstable)	1.2.25+ds1-1

https://github.com/Cacti/cacti/security/advisories/GHSA-v5w7-hww7-2f22