CVEvulnerability
CVE-2019-17358
8.1 HIGH
Official page ↗
- Status
- Modified
- Published
- 2019-12-12
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 8.1 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
- CVSS 2.0 ([email protected])
- 5.5 MEDIUM — AV:N/AC:L/Au:S/C:N/I:P/A:P
- Weaknesses
- CWE-502, CWE-787
Description
Cacti through 1.2.7 is affected by multiple instances of lib/functions.php unsafe deserialization of user-controlled data to populate arrays. An authenticated attacker could use this to influence object data values and control actions taken by Cacti or potentially cause memory corruption in the PHP module.
Affected configurations
• cacti cacti (<= 1.2.7)
• debian debian linux 8.0
• opensuse leap 42.3
Related
References
- http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00001.html lists.opensuse.org
- http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00005.html lists.opensuse.org
- http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00042.html lists.opensuse.org
- http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00048.html lists.opensuse.org
- https://bugzilla.suse.com/show_bug.cgi?id=CVE-2019-17358 Issue Tracking, Third Party Advisory
- https://github.com/Cacti/cacti/blob/79f29cddb5eb05cbaff486cd634285ef1fed9326/lib/functions.php#L3109 Exploit, Third Party Advisory
- https://github.com/Cacti/cacti/commit/adf221344359f5b02b8aed43dfb6b33ae5d708c8 Product, Third Party Advisory
- https://github.com/Cacti/cacti/issues/3026 Issue Tracking, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2019/12/msg00014.html Mailing List, Third Party Advisory
- https://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-17358.html Third Party Advisory
- https://seclists.org/bugtraq/2020/Jan/25 seclists.org
- https://security.gentoo.org/glsa/202003-40 security.gentoo.org
- https://www.darkmatter.ae/xen1thlabs/ Not Applicable
- https://www.debian.org/security/2020/dsa-4604 www.debian.org
- http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00001.html lists.opensuse.org
- http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00005.html lists.opensuse.org
- http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00042.html lists.opensuse.org
- http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00048.html lists.opensuse.org
- https://bugzilla.suse.com/show_bug.cgi?id=CVE-2019-17358 Issue Tracking, Third Party Advisory
- https://github.com/Cacti/cacti/blob/79f29cddb5eb05cbaff486cd634285ef1fed9326/lib/functions.php#L3109 Exploit, Third Party Advisory
- https://github.com/Cacti/cacti/commit/adf221344359f5b02b8aed43dfb6b33ae5d708c8 Product, Third Party Advisory
- https://github.com/Cacti/cacti/issues/3026 Issue Tracking, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2019/12/msg00014.html Mailing List, Third Party Advisory
- https://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-17358.html Third Party Advisory
- https://seclists.org/bugtraq/2020/Jan/25 seclists.org
- https://security.gentoo.org/glsa/202003-40 security.gentoo.org
- https://www.darkmatter.ae/xen1thlabs/ Not Applicable
- https://www.debian.org/security/2020/dsa-4604 www.debian.org