CVE-2024-45598

MediumCVSS 4.9/10Last modified Jun 17, 2026

Description

Cacti is an open source performance and fault management framework. Prior to 1.2.29, an administrator can change the `Poller Standard Error Log Path` parameter in either Installation Step 5 or in Configuration->Settings->Paths tab to a local file inside the server. Then simply going to Logs tab and selecting the name of the local file will show its content on the web UI. This vulnerability is fixed in 1.2.29.

Metrics

CVSS 3.1 4.9/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published: Jan 27, 2025
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-455993.8Cursor is an artificial intelligence code editor. Prior to version 0.41.0, if a user on macOS has granted Cursor access to the camera or mic CVE-2024-45609.8The Kognetiks Chatbot for WordPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the CVE-2024-456007.7Fields is a GLPI plugin that allows users to add custom fields on GLPI items forms. Prior to 1.21.13, an authenticated user can perform a SQ CVE-2024-456017.5Mesop is a Python-based UI framework designed for rapid web apps development. A vulnerability has been discovered and fixed in Mesop that co CVE-2024-456044.3Contao is an Open Source CMS. In affected versions authenticated users in the back end can list files outside the document root in the file CVE-2024-456054.3Sentry is a developer-first error tracking and performance monitoring platform. An authenticated user delete the user issue alert notificati CVE-2024-456064.3Sentry is a developer-first error tracking and performance monitoring platform. An authenticated user can mute alert rules from arbitrary or CVE-2024-456075.3whatsapp-api-js is a TypeScript server agnostic Whatsapp's Official API framework. It's possible to check the payload validation using the W CVE-2024-456088.8GLPI is a free asset and IT management software package. An authenticated user can perfom a SQL injection by changing its preferences. Upgra CVE-2024-456096.1GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing.CVE-2024-45615.3In WhatsUp Gold versions released before 2023.1.2 , a blind SSRF vulnerability exists in Whatsup Gold's FaviconController that allows an a CVE-2024-456106.1GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software aud