CVE-2023-39365

NameCVE-2023-39365
DescriptionCacti is an open source operational monitoring and fault management framework. Issues with Cacti Regular Expression validation combined with the external links feature can lead to limited SQL Injections and subsequent data leakage. This issue has been addressed in version 1.2.25. Users are advised to upgrade. There are no known workarounds for this vulnerability.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDSA-5550-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
cacti (PTS)buster1.2.2+ds1-2+deb10u4vulnerable
buster (security)1.2.2+ds1-2+deb10u5vulnerable
bullseye1.2.16+ds1-2+deb11u1vulnerable
bullseye (security)1.2.16+ds1-2+deb11u2fixed
bookworm1.2.24+ds1-1vulnerable
bookworm (security)1.2.24+ds1-1+deb12u1fixed
sid, trixie1.2.25+ds1-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
cactisourcebullseye1.2.16+ds1-2+deb11u2DSA-5550-1
cactisourcebookworm1.2.24+ds1-1+deb12u1DSA-5550-1
cactisource(unstable)1.2.25+ds1-1

Notes

https://github.com/Cacti/cacti/security/advisories/GHSA-v5w7-hww7-2f22
https://www.zerodayinitiative.com/advisories/ZDI-23-1499/
https://www.zerodayinitiative.com/advisories/ZDI-23-1500/
https://github.com/cacti/cacti/commit/f775c115e9d6e4b6a326eee682af8afebc43f20e

Search for package or bug name: Reporting problems