CVE-2024-45598 — Path Traversal in Cacti

CWE-22 — Path Traversal4 documents4 sources
Severity
4.9MEDIUMNVD
CNA6.0
EPSS
0.1%
top 75.10%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
CactiDebian Cacti
Timeline
PublishedJan 27

Description

Cacti is an open source performance and fault management framework. Prior to 1.2.29, an administrator can change the `Poller Standard Error Log Path` parameter in either Installation Step 5 or in Configuration->Settings->Paths tab to a local file inside the server. Then simply going to Logs tab and selecting the name of the local file will show its content on the web UI. This vulnerability is fixed in 1.2.29.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:NExploitability: 1.2 | Impact: 3.6

Affected Packages4 packages

▶CVEListV5cacti/cacti< 1.2.29
▶NVDcacti/cacti< 1.2.29
▶debiandebian/cacti< cacti 1.2.24+ds1-1+deb12u5 (bookworm)
▶Debiancacti/cacti< 1.2.16+ds1-2+deb11u5+3

Patches

Patch: github.com ↗

🔴Vulnerability Details

2
CVEList
Cacti has a Local File Inclusion (LFI) Vulnerability via Poller Standard Error Log Path↗2025-01-27
▶
OSV
CVE-2024-45598: Cacti is an open source performance and fault management framework↗2025-01-27
▶

📋Vendor Advisories

1
Debian
CVE-2024-45598: cacti - Cacti is an open source performance and fault management framework. Prior to 1.2...↗2024
▶