Vulnerability Description
Cacti through 1.2.7 is affected by multiple instances of lib/functions.php unsafe deserialization of user-controlled data to populate arrays. An authenticated attacker could use this to influence object data values and control actions taken by Cacti or potentially cause memory corruption in the PHP module.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Cacti | Cacti | <= 1.2.7 |
| Debian | Debian Linux | 8.0 |
| Opensuse | Leap | 42.3 |
Related Weaknesses (CWE)
References
- http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00001.html
- http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00005.html
- http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00042.html
- http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00048.html
- https://bugzilla.suse.com/show_bug.cgi?id=CVE-2019-17358Issue TrackingThird Party Advisory
- https://github.com/Cacti/cacti/blob/79f29cddb5eb05cbaff486cd634285ef1fed9326/libExploitThird Party Advisory
- https://github.com/Cacti/cacti/commit/adf221344359f5b02b8aed43dfb6b33ae5d708c8ProductThird Party Advisory
- https://github.com/Cacti/cacti/issues/3026Issue TrackingThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2019/12/msg00014.htmlMailing ListThird Party Advisory
- https://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-17358.htmlThird Party Advisory
- https://seclists.org/bugtraq/2020/Jan/25
- https://security.gentoo.org/glsa/202003-40
- https://www.darkmatter.ae/xen1thlabs/Not Applicable
- https://www.debian.org/security/2020/dsa-4604
- http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00001.html
FAQ
What is CVE-2019-17358?
CVE-2019-17358 is a vulnerability with a CVSS score of 8.1 (HIGH). Cacti through 1.2.7 is affected by multiple instances of lib/functions.php unsafe deserialization of user-controlled data to populate arrays. An authenticated attacker could use this to influence obje...
How severe is CVE-2019-17358?
CVE-2019-17358 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2019-17358?
Check the references section above for vendor advisories and patch information. Affected products include: Cacti Cacti, Debian Debian Linux, Opensuse Leap.