CVE-2023-39365CWE-89

Unchecked regular expressions can lead to SQL Injection and data leakage in Cacti

Medium · published September 5, 2023

CVSS v3.1
4.6
EPSS
1%
Percentile
57.8
In the wild
Unconfirmed
What it is

Cacti is an open source operational monitoring and fault management framework. Issues with Cacti Regular Expression validation combined with the external links feature can lead to limited SQL Injections and subsequent data leakage. This issue has been addressed in version 1.2.25. Users are advised to upgrade. There are no known workarounds for this vulnerability.

The record
Technical detail
CVSS v3.1
4.6 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00850 · 57.8th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2023-09-05T21:03Z
EPSS history
Timeline
  • 05 SEP 21:03Z
    Unchecked regular expressions can lead to SQL Injection and data leakage in Cacti
    cvelistv5