Unrated
Cacti through 1.2.7 is affected by a graphs.php?template_id= SQL injection vulnerability affecting how template identifiers are handled when a string...
CVE-2019-17357
First seen on SecPulse
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2019-17357 cacti Fixed in: 1.2.8+ds1-1
Original description The description as published by the source.
Cacti through 1.2.7 is affected by a graphs.php?template_id= SQL injection vulnerability affecting how template identifiers are handled when a string and id composite value are used to identify the template type and id. An authenticated attacker can exploit this to extract data from the database, or an unauthenticated remote attacker could exploit this via Cross-Site Request Forgery.
References
- advisory security.gentoo.org
- patch github.com
- report bugs.debian.org
- web lists.opensuse.org
- web lists.opensuse.org
- web lists.opensuse.org
- web lists.opensuse.org
- web darkmatter.ae