Medium severity · published Jan 21, 2020
CVE-2019-17357
Cacti through 1.2.7 is affected by a graphs.php?template_id= SQL injection vulnerability affecting how template identifiers are handled when a string and id composite value are…
6.5
CVSS
34.2%
EPSS
No
On KEV
Description
Cacti through 1.2.7 is affected by a graphs.php?template_id= SQL injection vulnerability affecting how template identifiers are handled when a string and id composite value are used to identify the template type and id. An authenticated attacker can exploit this to extract data from the database, or an unauthenticated remote attacker could exploit this via Cross-Site Request Forgery.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)34.2% · higher than 98% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CA
Cacti · Cacti
through 1.2.7 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-17357
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-17357
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00001.html
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00005.html
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00042.html
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00048.html
Issue Tracking
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=947374
Patch
https://github.com/Cacti/cacti/issues/3025
More from Cacti
9.8
CVE-2022-46169
Unauthenticated Command Injection
9.8
CVE-2026-40079
Cacti: Command Injection via escape_command() no-op in RRDtool execution
9.8
CVE-2026-39948
Cacti has SQL Injection via rfilter parameter in RLIKE clauses
9.8
CVE-2026-39955
Cacti has Pre-Authentication SQL Injection via unanchored FILTER_VALIDATE_REGEXP in graph_view.php
9.8
CVE-2026-39938
Cacti: Unauthenticated RCE on Graph Image