CVE-2024-31460

Katalog CVE

CVSS 8.8 · High EPSS 1,8%

Kerentanan Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') pada cacti, fedoraproject fedora. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, some of the data stored in `automation_tree_rules.php` is not thoroughly checked and is used to concatenate the SQL statement in `create_all_header_nodes()` function from `lib/api_automation.php` , finally resulting in SQL injection. Using SQL based secondary injection technology, attackers can modify the contents of the Cacti database, and based on the modified content, it may be possible to achieve further impact, such as arbitrary file reading, and even remote code execution through arbitrary file writing. Version 1.2.27 contains a patch for the issue.

Rincian

Terbit di NVD

14 Mei 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

EPSS (30 hari)

1,8% peluang dieksploitasi; lebih tinggi dari 77,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/Cacti/cacti/security/advisories/GHSA-cx8g-hvq8-p2rv exploit · advisory vendor
• https://github.com/Cacti/cacti/security/advisories/GHSA-gj3f-p326-gh8r exploit · advisory vendor
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RBEOAFKRARQHTDI... product
• https://lists.debian.org/debian-lts-announce/2024/09/msg00027.html