Vulnerability Name:

CVE-2019-17357 (CCN-174810)

Assigned:2019-10-13
Published:2019-10-13
Updated:2020-03-01
Summary:Cacti through 1.2.7 is affected by a graphs.php?template_id= SQL injection vulnerability affecting how template identifiers are handled when a string and id composite value are used to identify the template type and id. An authenticated attacker can exploit this to extract data from the database, or an unauthenticated remote attacker could exploit this via Cross-Site Request Forgery.
CVSS v3 Severity:6.5 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
6.2 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:H/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): None
Availibility (A): None
6.5 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
6.2 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:H/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): None
CVSS v2 Severity:4.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:S/C:P/I:N/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): Partial
Integrity (I): None
Availibility (A): None
6.4 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): None
Vulnerability Type:CWE-89
Vulnerability Consequences:Data Manipulation
References:Source: MITRE
Type: CNA
CVE-2019-17357

Source: SUSE
Type: UNKNOWN
openSUSE-SU-2020:0272

Source: SUSE
Type: UNKNOWN
openSUSE-SU-2020:0284

Source: SUSE
Type: UNKNOWN
openSUSE-SU-2020:0558

Source: SUSE
Type: UNKNOWN
openSUSE-SU-2020:0565

Source: MISC
Type: Issue Tracking, Third Party Advisory
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=947374

Source: XF
Type: UNKNOWN
cacti-cve201917357-sql-injection(174810)

Source: CCN
Type: Cacti GIT Repository
When viewing graphs, some input variables are not properly checked (SQL injection possible) #3025

Source: CONFIRM
Type: Patch, Third Party Advisory
https://github.com/Cacti/cacti/issues/3025

Source: CCN
Type: BugTraq Mailing List, Sun, 19 Jan 2020 21:49:03 +0000
[SECURITY] [DSA 4604-1] cacti security update

Source: GENTOO
Type: UNKNOWN
GLSA-202003-40

Source: MISC
Type: Broken Link
https://www.darkmatter.ae/xen1thlabs/

Vulnerable Configuration:Configuration 1:
  • cpe:/a:cacti:cacti:*:*:*:*:*:*:*:* (Version <= 1.2.7)

    • Configuration CCN 1:
  • cpe:/a:cacti:cacti:1.2.7:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:201917357
    V
    		CVE-2019-17357
    2022-06-30
    oval:org.opensuse.security:def:112039
    P
    		cacti-1.2.18-1.2 on GA media (Moderate)
    2022-01-17
    oval:org.opensuse.security:def:64643
    P
    		Security update for kernel-firmware (Low)
    2021-12-30
    oval:org.opensuse.security:def:74745
    P
    		Security update for the Linux Kernel (Important)
    2021-11-16
    oval:org.opensuse.security:def:64585
    P
    		Security update for libcryptopp (Moderate)
    2021-10-06
    oval:org.opensuse.security:def:105594
    P
    		cacti-1.2.18-1.2 on GA media (Moderate)
    2021-10-01
    oval:org.opensuse.security:def:63246
    P
    		xen-4.12.0_12-1.1 on GA media (Moderate)
    2021-09-21
    oval:org.opensuse.security:def:64755
    P
    		Security update for spectre-meltdown-checker (Moderate)
    2021-08-27
    oval:org.opensuse.security:def:64558
    P
    		Security update for fetchmail (Moderate)
    2021-08-20
    oval:org.opensuse.security:def:93574
    P
    		 (Important)
    2021-08-12
    oval:org.opensuse.security:def:63449
    P
    		postgresql-test-12-2.2 on GA media (Moderate)
    2021-08-10
    oval:org.opensuse.security:def:63331
    P
    		grub2-x86_64-xen-2.04-20.4 on GA media (Moderate)
    2021-08-10
    oval:org.opensuse.security:def:62747
    P
    		gd-2.2.5-9.1 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:62743
    P
    		fontforge-20200314-3.3.1 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:62832
    P
    		texlive-collection-basic-2017.135.svn41616-9.12.1 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:62775
    P
    		libass-devel-0.14.0-3.3.1 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:62828
    P
    		rtkit-0.11+git.20130926-1.34 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:63038
    P
    		perl-doc-5.26.1-15.87 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:62750
    P
    		gnome-autoar-devel-0.2.3-3.3.1 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:62835
    P
    		vorbis-tools-1.4.0-1.53 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:100311
    P
    		 (Moderate)
    2021-07-20
    oval:org.opensuse.security:def:63534
    P
    		freerdp-2.0.0~rc2-1.8 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:62860
    P
    		libtidy-devel-5.4.0-1.34 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:100287
    P
    		 (Important)
    2021-06-02
    oval:org.opensuse.security:def:64500
    P
    		Recommended update for grub2 (Moderate)
    2021-05-19
    oval:org.opensuse.security:def:64483
    P
    		Security update for webkit2gtk3 (Important)
    2021-04-29
    oval:org.opensuse.security:def:64670
    P
    		Security update for nghttp2 (Important)
    2021-03-24
    oval:org.opensuse.security:def:93598
    P
    		 (Important)
    2021-03-24
    oval:org.opensuse.security:def:74697
    P
    		Security update for git (Important)
    2021-03-09
    oval:org.opensuse.security:def:62953
    P
    		gradle-4.4.1-1.87 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:63596
    P
    		libwmf-0_2-7-0.2.8.4-2.30 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:74830
    P
    		Security update for cacti, cacti-spine (Important)
    2020-12-01
    oval:org.opensuse.security:def:25070
    P
    		Security update for xen (Important)
    2020-12-01
    oval:org.opensuse.security:def:25635
    P
    		Security update for tigervnc (Critical)
    2020-12-01
    oval:org.opensuse.security:def:63681
    P
    		Security update for qemu (Important)
    2020-12-01
    oval:org.opensuse.security:def:25059
    P
    		Security update for apache2-mod_auth_openidc (Important)
    2020-12-01
    oval:org.opensuse.security:def:64291
    P
    		lftp on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25484
    P
    		Security update for libqt4 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26507
    P
    		Security update for cacti, cacti-spine (Important)
    2020-12-01
    oval:org.opensuse.security:def:64290
    P
    		less on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25400
    P
    		Security update for bcm43xx-firmware (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26472
    P
    		Security update for Chromium (Important)
    2020-12-01
    oval:org.opensuse.security:def:64376
    P
    		libpython3_6m1_0 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:64154
    P
    		Security update for MozillaFirefox (Important)
    2020-12-01
    oval:org.opensuse.security:def:25343
    P
    		Security update for kernel-firmware (Important)
    2020-12-01
    oval:org.opensuse.security:def:25834
    P
    		Security update for the Linux Kernel (Important)
    2020-12-01
    oval:org.opensuse.security:def:64375
    P
    		libpython2_7-1_0 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:63825
    P
    		Security update for ucode-intel (Important)
    2020-12-01
    oval:org.opensuse.security:def:25262
    P
    		Security update for spamassassin (Important)
    2020-12-01
    oval:org.opensuse.security:def:25790
    P
    		Security update for flash-player (Important)
    2020-12-01
    oval:org.opensuse.security:def:25058
    P
    		Security update for gdb (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:64398
    P
    		libvirt-libs on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:64239
    P
    		dhcp on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25134
    P
    		Security update for apache2 (Important)
    2020-12-01
    oval:org.opensuse.security:def:74612
    P
    		Security update for dpdk (Critical)
    2020-12-01
    oval:org.opensuse.security:def:25776
    P
    		Security update for flash-player (Critical)
    2020-12-01
    oval:org.opensuse.security:def:25688
    P
    		Security update for systemd (Important)
    2020-12-01
    oval:org.opensuse.security:def:63910
    P
    		Security update for ovmf (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:110492
    P
    		Security update for cacti, cacti-spine (Important)
    2020-04-27
    oval:org.opensuse.security:def:110407
    P
    		Security update for cacti, cacti-spine (Important)
    2020-03-01
    oval:com.ubuntu.bionic:def:2019173570000000
    V
    		CVE-2019-17357 on Ubuntu 18.04 LTS (bionic) - medium.
    2020-01-21
    oval:com.ubuntu.xenial:def:2019173570000000
    V
    		CVE-2019-17357 on Ubuntu 16.04 LTS (xenial) - medium.
    2020-01-21
    oval:com.ubuntu.disco:def:2019173570000000
    V
    		CVE-2019-17357 on Ubuntu 19.04 (disco) - medium.
    2019-12-11
    BACK
    cacti cacti *
    cacti cacti 1.2.7