High severity · published Dec 21, 2023
CVE-2023-49084
Cacti is a robust performance and fault management framework and a frontend to RRDTool - a Time Series Database (TSDB)
8.8
CVSS
64.4%
EPSS
No
On KEV
Description
Cacti is a robust performance and fault management framework and a frontend to RRDTool - a Time Series Database (TSDB). While using the detected SQL Injection and insufficient processing of the include file path, it is possible to execute arbitrary code on the server. Exploitation of the vulnerability is possible for an authorized user. The vulnerable component is the `link.php`. Impact of the vulnerability execution of arbitrary code on the server.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)64.4% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CA
Cacti · Cacti
1.2.25 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-49084
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-49084
packetstormsecurity.com
http://packetstormsecurity.com/files/176995/Cacti-pollers.php-SQL-Injection-Remote-Code-Execution.html
Exploit
https://github.com/Cacti/cacti/security/advisories/GHSA-pfh9-gwm6-86vp
lists.debian.org
https://lists.debian.org/debian-lts-announce/2024/03/msg00018.html
lists.fedoraproject.org
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RBEOAFKRARQHTDIYSL723XAFJ2Q6624X/
More from Cacti
9.8
CVE-2022-46169
Unauthenticated Command Injection
9.8
CVE-2026-40079
Cacti: Command Injection via escape_command() no-op in RRDtool execution
9.8
CVE-2026-39948
Cacti has SQL Injection via rfilter parameter in RLIKE clauses
9.8
CVE-2026-39955
Cacti has Pre-Authentication SQL Injection via unanchored FILTER_VALIDATE_REGEXP in graph_view.php
9.8
CVE-2026-39938
Cacti: Unauthenticated RCE on Graph Image