CVE-2023-39361

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a SQL injection discovered in graph_view.php. Since guest users can access graph_view.php without authentication by default, if guest users are being utilized in an enabled state, there could be the potential for significant damage. Attackers may exploit this vulnerability, and there may be possibilities for actions such as the usurpation of administrative privileges or remote code execution. This issue has been addressed in version 1.2.25. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Sep 5, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-393627.2Cacti is an open source operational monitoring and fault management framework. In Cacti 1.2.24, under certain conditions, an authenticated p CVE-2023-393635.9Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine (EVM). In versions 0.2.15, 0.2.16 and 0.3.0, named re-entrancy CVE-2023-393645.4Cacti is an open source operational monitoring and fault management framework. In Cacti 1.2.24, users with console access can be redirected CVE-2023-393656.3Cacti is an open source operational monitoring and fault management framework. Issues with Cacti Regular Expression validation combined with CVE-2023-393664.8Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scriptin CVE-2023-393677.2An OS command injection vulnerability exists in the web interface mac2name functionality of Peplink Smart Reader v1.2.0 (in QEMU). A special CVE-2023-393686.5Protection mechanism failure of bus lock regulator for some Intel(R) Processors may allow an unauthenticated user to potentially enable deni CVE-2023-393696.1StarTrinity Softswitch version 2023-02-16 - Multiple Reflected XSS (CWE-79)CVE-2023-39374.8Cross site scripting vulnerability in web portal in Snow Software License Manager from version 9.0.0 up to and including 9.30.1 on Windows a CVE-2023-393705.4StarTrinity Softswitch version 2023-02-16 - Persistent XSS (CWE-79)CVE-2023-393716.1StarTrinity Softswitch version 2023-02-16 - Open Redirect (CWE-601)CVE-2023-393728.8StarTrinity Softswitch version 2023-02-16 - Multiple CSRF (CWE-352)