CVE-2023-49084
Last modified
CVE-2023-49084 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. Cacti is a robust performance and fault management framework and a frontend to RRDTool - a Time Series Database (TSDB). While using the detected SQL Injection and insufficient processing of the include file path, it is possible to execute arbitrary code on the server. EPSS estimates a 63.77% chance of exploitation in the next 30 days.
Description
Cacti is a robust performance and fault management framework and a frontend to RRDTool - a Time Series Database (TSDB). While using the detected SQL Injection and insufficient processing of the include file path, it is possible to execute arbitrary code on the server. Exploitation of the vulnerability is possible for an authorized user. The vulnerable component is the `link.php`. Impact of the vulnerability execution of arbitrary code on the server.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Cacti | Cacti | 1.2.25 |
References
- https://github.com/Cacti/cacti/security/advisories/GHSA-pfh9-gwm6-86vpExploit, Vendor Advisory
- https://github.com/Cacti/cacti/security/advisories/GHSA-pfh9-gwm6-86vpExploit, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2023-49084?
How severe is CVE-2023-49084?
How do I fix CVE-2023-49084?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2023
- CVE-2023-49079Misskey is an open source, decentralized social media platfo…7.5
- CVE-2023-4908Inappropriate implementation in Picture in Picture in Google…4.3
- CVE-2023-49080The Jupyter Server provides the backend (i.e. the core servi…4.3
- CVE-2023-49081aiohttp is an asynchronous HTTP client/server framework for …5.3
- CVE-2023-49082aiohttp is an asynchronous HTTP client/server framework for …5.3
- CVE-2023-49083cryptography is a package designed to expose cryptographic p…7.5
- CVE-2023-49085Cacti provides an operational monitoring and fault managemen…8.8
- CVE-2023-49086Cacti is a robust performance and fault management framework…5.4
- CVE-2023-49087xml-security is a library that implements XML signatures and…7.5
- CVE-2023-49088Cacti is an open source operational monitoring and fault man…4.8
- CVE-2023-49089Umbraco is an ASP.NET content management system (CMS). Start…6.5
- CVE-2023-4909Inappropriate implementation in Interstitials in Google Chro…4.3
Are you affected by CVE-2023-49084?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST