Описание
Cacti is an open source performance and fault management framework. Some of the data stored in automation_tree_rules.php is not thoroughly checked and is used to concatenate the SQL statement in build_rule_item_filter() function from lib/api_automation.php, resulting in SQL injection. This vulnerability is fixed in 1.2.29.
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| cacti | fixed | 1.2.28+ds1-4 | package |
Примечания
https://github.com/Cacti/cacti/security/advisories/GHSA-f9c7-7rc3-574c
Backend fixed by: https://github.com/Cacti/cacti/commit/8b516cb9a73322ad532231e74000c2ee097b495e (release/1.2.27)
Frontend fixed by: https://github.com/Cacti/cacti/commit/c7e4ee798d263a3209ae6e7ba182c7b65284d8f0 (release/1.2.29)
Frontend follow-up #1: https://github.com/Cacti/cacti/commit/94526a92b96c01848748602977819cd403932f0a (1.2.x)
Frontend regression: https://github.com/Cacti/cacti/issues/6090
Frontend fix optional: https://github.com/Cacti/cacti/pull/6094#issuecomment-2643321503
EPSS
Связанные уязвимости
Cacti is an open source performance and fault management framework. Some of the data stored in automation_tree_rules.php is not thoroughly checked and is used to concatenate the SQL statement in build_rule_item_filter() function from lib/api_automation.php, resulting in SQL injection. This vulnerability is fixed in 1.2.29.
Cacti is an open source performance and fault management framework. Some of the data stored in automation_tree_rules.php is not thoroughly checked and is used to concatenate the SQL statement in build_rule_item_filter() function from lib/api_automation.php, resulting in SQL injection. This vulnerability is fixed in 1.2.29.
Уязвимость функции build_rule_item_filter() сценария api_automation.php программного средства мониторинга сети Cacti, позволяющая нарушителю выполнить произвольный код
EPSS