CVE-2024-31460 — SQL Injection in Cacti

CWE-89 — SQL Injection5 documents5 sources
Severity
8.8HIGHNVD
CNA6.5
EPSS
1.7%
top 17.72%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
CactiFedoraproject Fedora
Timeline
PublishedMay 14
Latest updateAug 20

Description

Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, some of the data stored in `automation_tree_rules.php` is not thoroughly checked and is used to concatenate the SQL statement in `create_all_header_nodes()` function from `lib/api_automation.php` , finally resulting in SQL injection. Using SQL based secondary injection technology, attackers can modify the contents of the Cacti database, and based on the modified content, it may be possible to achiev…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages3 packages

▶CVEListV5cacti/cacti< 1.2.27
▶NVDcacti/cacti< 1.2.27
▶Debiancacti/cacti< 1.2.16+ds1-2+deb11u4+3

Also affects: Fedora 39

🔴Vulnerability Details

2
OSV
CVE-2024-31460: Cacti provides an operational monitoring and fault management framework↗2024-05-14
▶
CVEList
Cacti SQL Injection vulnerability in lib/api_automation.php caused by reading dirty data stored in database↗2024-05-13
▶

📋Vendor Advisories

2
Ubuntu
Cacti vulnerabilities↗2024-08-20
▶
Debian
CVE-2024-31460: cacti - Cacti provides an operational monitoring and fault management framework. Prior t...↗2024
▶
CVE-2024-31460 — SQL Injection in Cacti | cvebase