Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2023-49084: Cacti lets authorized users run code on server

CVE-2023-49084 · published 2 years ago

Summary

The Cacti monitoring tool on Debian can be tricked by a logged‑in user to load a malicious file through the link.php page. This lets the attacker execute any code they choose on the server, potentially compromising the system. Apply the latest security update for Cacti or restrict access to trusted users only.

What to do

Update debian cacti to version 1.2.24+ds1-1+deb12u2.
Update debian cacti to version 1.2.26+ds1-1.

Affected software

Ecosystem	Vendor	Product	Affected versions
Debian:12	debian	cacti	< 1.2.24+ds1-1+deb12u2 Fix: upgrade to 1.2.24+ds1-1+deb12u2
Debian:13	debian	cacti	< 1.2.26+ds1-1 Fix: upgrade to 1.2.26+ds1-1
Debian:14	debian	cacti	< 1.2.26+ds1-1 Fix: upgrade to 1.2.26+ds1-1
–	cacti	cacti	1.2.25 `cpe:2.3:a:cacti:cacti:1.2.25:::::::*`

Original advisory text

Local File Inclusion (RCE) in Cacti

Cacti is a robust performance and fault management framework and a frontend to RRDTool - a Time Series Database (TSDB). While using the detected SQL Injection and insufficient processing of the include file path, it is possible to execute arbitrary code on the server. Exploitation of the vulnerability is possible for an authorized user. The vulnerable component is the `link.php`. Impact of the vulnerability execution of arbitrary code on the server.

References

https://security-tracker.debian.org/tracker/CVE-2023-49084 Vendor Advisory
http://packetstormsecurity.com/files/176995/Cacti-pollers.php-SQL-Injection-Remo... URL
https://lists.debian.org/debian-lts-announce/2024/03/msg00018.html URL
https://lists.fedoraproject.org/archives/list/[email protected]... URL
https://github.com/Cacti/cacti/security/advisories/GHSA-pfh9-gwm6-86vp Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/49xxx/CVE-2023-49084... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-49084 Vendor Advisory

Severity

8.8 High

Exploitation

64% chance of attack within 30 days

Type

CWE-98Improper Control of Filename for Include

Timeline

Published21 Dec 2023

Updated23 Oct 2026

First seen15 Sep 2026

Sources

DEBIAN-CVE-2023-49084 · OSV

CVE-2023-49084 · NVD

CVE-2023-49084 · OSV

GHSA-pfh9-gwm6-86vp · GHSA

Track software like this

Free during beta