CVE-2023-39365: Cacti is an open source operational monitoring and fault management framework. Issues with Cacti Regular Expression validation combined with the external links…

PriorityP336medium6.3CVSS 3.1

AVNACLPRLUINSUCLILAL

EPSS

0.86%

54.7th percentile

Cacti is an open source operational monitoring and fault management framework. Issues with Cacti Regular Expression validation combined with the external links feature can lead to limited SQL Injections and subsequent data leakage. This issue has been addressed in version 1.2.25. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected

8 ranges

Vendor	Product	Version range	Fixed in
cacti	cacti	< 1.2.25	1.2.25
cacti	cacti	>= 0 < 1.2.16+ds1-2+deb11u2	1.2.16+ds1-2+deb11u2
cacti	cacti	>= 0 < 1.2.24+ds1-1+deb12u1	1.2.24+ds1-1+deb12u1
cacti	cacti	>= 0 < 1.2.25+ds1-1	1.2.25+ds1-1
cacti	cacti	>= 0 < 1.2.25+ds1-1	1.2.25+ds1-1
debian	cacti	< cacti 1.2.24+ds1-1+deb12u1 (bookworm)	cacti 1.2.24+ds1-1+deb12u1 (bookworm)
fedoraproject	fedora	—	—
fedoraproject	fedora	—	—

CVSS provenance

nvdv3.16.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

osv6.3MEDIUM

vendor_debian4.6MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.