SQL Injection vulnerability when managing SNMP Notification Receivers
概要
SQL Injection vulnerability when managing SNMP Notification Receivers
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
Cacti provides an operational monitoring and fault management framework. Version 1.2.25 has a Blind SQL Injection (SQLi) vulnerability within the SNMP Notification Receivers feature in the file ‘managers.php’. An authenticated attacker with the “Settings/Utilities” permission can send a crafted HTTP GET request to the endpoint ‘/cacti/managers.php’ with an SQLi payload in the ‘selected_graphs_array’ HTTP GET parameter. As of time of publication, no patched versions exist.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
ディストリビューション別の修正状況
各ディストリビューションが公開している、この CVE の修正パッケージ
- Debian DEBIAN-CVE-2023-51448 cacti 修正版: 1.2.26+ds1-1
参照URL
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- web github.com
- web lists.fedoraproject.org