Unauthenticated SQL Injection in graph_view.php in Cacti
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- SQL injection
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-89.
Summary
Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a SQL injection discovered in graph_view.php. Since guest users can access graph_view.php without authentication by default, if guest users are being utilized in an enabled state, there could be the potential for significant damage. Attackers may exploit this vulnerability, and there may be possibilities for actions such as the usurpation of administrative privileges or remote code execution. This issue has been addressed in version 1.2.25. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Cacti | cacti | before 1.2.25 | 1.2.25 | Patch available | CNA |
- cacti VendorCacti Affected before 1.2.25 Fixed in 1.2.25 Patch available CNA
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:cacti:cacti:1.2.24:*:*:*:*:*:*:* | 1.2.24 | Vulnerable | Cacti |
| cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* | 37 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* | 38 | Vulnerable | Fedoraproject |
- cpe:2.3:a:cacti:cacti:1.2.24:*:*:*:*:*:*:* Versions 1.2.24 Vulnerable ·Cacti
- cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* Versions 37 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* Versions 38 Vulnerable ·Fedoraproject
Remediation
- Fix · CNA cacti (Cacti) Fixed in 1.2.25
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2023-39361
References
Other 5
- https://lists.fedoraproject.org/archives/list/[email protected]/message/WZGB2UXJEUYWWA6IWVFQ3ZTP22FIHMGN/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/CFH3J2WVBKY4ZJNMARVOWJQK6PSLPHFH/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/WOQFYGLZBAWT4AWNMO7DU73QXWPXTCKH/
- https://www.debian.org/security/2023/dsa-5550
- https://lists.debian.org/debian-lts-announce/2024/03/msg00018.html
More Cacti vulnerabilities
- TI-2022-22813 Unauthenticated command injection in cacti KEVCVSS 3.1CRITICAL 9.8
- TI-2024-16869 Cacti RCE vulnerability when importing packages CVSS 3.1CRITICAL 9.1
- TI-2024-20809 SQL Injection vulnerability in automation_get_new_graphs_sql CVSS 3.1HIGH 8.8
- TI-2023-26750 Cacti SQL Injection vulnerability CVSS 3.1HIGH 8.8
- TI-2025-18110 Cacti allows Arbitrary File Creation leading to RCE CVSS 4.0HIGH 8.7
- TI-2023-26749 Local File Inclusion (RCE) in Cacti CVSS 3.1HIGH 8.8
Sources
- CVE-2023-39361 · CVE Program
- CVE-2023-39361 · NVD
- FIRST EPSS
- CVE-2023-39361 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences