Описание
In Cacti through 1.2.6, authenticated users may bypass authorization checks (for viewing a graph) via a direct graph_json.php request with a modified local_graph_id parameter.
| Релиз | Статус | Примечание |
|---|---|---|
| bionic | ignored | end of standard support, was needed |
| devel | not-affected | 1.2.16+ds1-2ubuntu1 |
| disco | ignored | end of life |
| eoan | ignored | end of life |
| esm-apps/bionic | needed | |
| esm-apps/focal | not-affected | 1.2.10+ds1-1ubuntu1 |
| esm-apps/jammy | not-affected | 1.2.16+ds1-2ubuntu1 |
| esm-apps/noble | not-affected | 1.2.16+ds1-2ubuntu1 |
| esm-apps/xenial | not-affected | code not present |
| esm-infra-legacy/trusty | needs-triage |
Показывать по
EPSS
4 Medium
CVSS2
4.3 Medium
CVSS3
Связанные уязвимости
In Cacti through 1.2.6, authenticated users may bypass authorization checks (for viewing a graph) via a direct graph_json.php request with a modified local_graph_id parameter.
In Cacti through 1.2.6, authenticated users may bypass authorization c ...
In Cacti through 1.2.6, authenticated users may bypass authorization checks (for viewing a graph) via a direct graph_json.php request with a modified local_graph_id parameter.
Уязвимость функции local_graph_id системы мониторинга сервера Cacti, связанная с обходом авторизации посредством использования ключа, контролируемого пользователем, позволяющая нарушителю получить доступ к конфиденциальным данным
EPSS
4 Medium
CVSS2
4.3 Medium
CVSS3