CVE-2019-17357

Description

Cacti through 1.2.7 is affected by a graphs.php?template_id= SQL injection vulnerability affecting how template identifiers are handled when a string and id composite value are used to identify the template type and id. An authenticated attacker can exploit this to extract data from the database, or an unauthenticated remote attacker could exploit this via Cross-Site Request Forgery.

References

https://www.darkmatter.ae/xen1thlabs/

https://security.gentoo.org/glsa/202003-40

https://github.com/Cacti/cacti/issues/3025

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=947374

http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00048.html

http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00042.html

http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00005.html

http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00001.html

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3