Vulnerability Description
Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, some of the data stored in `automation_tree_rules.php` is not thoroughly checked and is used to concatenate the SQL statement in `create_all_header_nodes()` function from `lib/api_automation.php` , finally resulting in SQL injection. Using SQL based secondary injection technology, attackers can modify the contents of the Cacti database, and based on the modified content, it may be possible to achieve further impact, such as arbitrary file reading, and even remote code execution through arbitrary file writing. Version 1.2.27 contains a patch for the issue.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Cacti | Cacti | < 1.2.27 |
| Fedoraproject | Fedora | 39 |
Related Weaknesses (CWE)
References
- https://github.com/Cacti/cacti/security/advisories/GHSA-cx8g-hvq8-p2rvExploitVendor Advisory
- https://github.com/Cacti/cacti/security/advisories/GHSA-gj3f-p326-gh8rExploitVendor Advisory
- https://lists.fedoraproject.org/archives/list/[email protected]Product
- https://github.com/Cacti/cacti/security/advisories/GHSA-cx8g-hvq8-p2rvExploitVendor Advisory
- https://github.com/Cacti/cacti/security/advisories/GHSA-gj3f-p326-gh8rExploitVendor Advisory
- https://lists.debian.org/debian-lts-announce/2024/09/msg00027.html
- https://lists.fedoraproject.org/archives/list/[email protected]Product
FAQ
What is CVE-2024-31460?
CVE-2024-31460 is a vulnerability with a CVSS score of 6.5 (MEDIUM). Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, some of the data stored in `automation_tree_rules.php` is not thoroughly checked and is used to concat...
How severe is CVE-2024-31460?
CVE-2024-31460 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2024-31460?
Check the references section above for vendor advisories and patch information. Affected products include: Cacti Cacti, Fedoraproject Fedora.