CVE-2023-46490 — SQL Injection in Cacti

CWE-89 — SQL Injection4 documents4 sources
Severity
6.5MEDIUMNVD
EPSS
0.2%
top 56.92%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
CactiDebian Cacti
Timeline
PublishedOct 27
Latest updateOct 28

Description

SQL Injection vulnerability in Cacti v1.2.25 allows a remote attacker to obtain sensitive information via the form_actions() function in the managers.php function.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages3 packages

▶debiandebian/cacti< cacti 1.2.26+ds1-1 (forky)
▶Debiancacti/cacti< 1.2.26+ds1-1+1
▶NVDcacti/cacti1.2.25

🔴Vulnerability Details

2
GHSA
GHSA-6xmf-7cqj-2h8m: SQL Injection vulnerability in Cacti v1↗2023-10-28
▶
OSV
CVE-2023-46490: SQL Injection vulnerability in Cacti v1↗2023-10-27
▶

📋Vendor Advisories

1
Debian
CVE-2023-46490: cacti - SQL Injection vulnerability in Cacti v1.2.25 allows a remote attacker to obtain ...↗2023
▶