CVE-2023-39357
cacti - security update
描述
Cacti is an open source operational monitoring and fault management framework. A defect in the sql_save function was discovered. When the column type is numeric, the sql_save function directly utilizes user input. Many files and functions calling the sql_save function do not perform prior validation of user input, leading to the existence of multiple SQL injection vulnerabilities in Cacti. This allows authenticated users to exploit these SQL injection vulnerabilities to perform privilege escalation and remote code execution. This issue has been addressed in version 1.2.25. Users are advised to upgrade. There are no known workarounds for this vulnerability.
如何修補 CVE-2023-39357
要修補 CVE-2023-39357,請將受影響套件升級到下列已修補版本。
- —升級至 1.2.16+ds1-2+deb11u2 或更新版本
- —升級至 1.2.2+ds1-2+deb10u6 或更新版本
- —升級至 1.2.16+ds1-2+deb11u2 或更新版本
CVE-2023-39357 正在被利用嗎?
低 — EPSS 為 1.5%,目前沒有觀察到大規模利用活動。
受影響套件(3)
- from 0, < 1.2.16+ds1-2+deb11u2
- from 0, < 1.2.2+ds1-2+deb10u6
- from 0, < 1.2.16+ds1-2+deb11u2
CVSS 分數
| 來源 | 版本 | 嚴重程度 | 向量 |
|---|---|---|---|
| osv | CVSS 3.1 | HIGH8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |