CVE-2023-49085CWE-89

Cacti SQL Injection vulnerability

High · published December 22, 2023

Patch now

High probability of exploitation

CVSS calls it high at 8.8. It sits in the 99.5th percentile for exploit probability.

CVSS v3.1

8.8

EPSS

74%

Percentile

99.5

In the wild

Unconfirmed

What it is

Cacti provides an operational monitoring and fault management framework. In versions 1.2.25 and prior, it is possible to execute arbitrary SQL code through the `pollers.php` script. An authorized user may be able to execute arbitrary SQL code. The vulnerable component is the `pollers.php`. Impact of the vulnerability - arbitrary SQL code execution. As of time of publication, a patch does not appear to exist.

The record

Technical detail

CVSS v3.1: 8.8 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0: Not supplied
EPSS: 0.74451 · 99.5th percentile
Weakness: CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published: 2023-12-22T16:13Z

EPSS history

Timeline

22 DEC 16:13Z
Cacti SQL Injection vulnerability
cvelistv5