CVE-2019-17357

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 34.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-01-21 · updated 2026-06-17
Weakness: CWE-89

Description

Cacti through 1.2.7 is affected by a graphs.php?template_id= SQL injection vulnerability affecting how template identifiers are handled when a string and id composite value are used to identify the template type and id. An authenticated attacker can exploit this to extract data from the database, or an unauthenticated remote attacker could exploit this via Cross-Site Request Forgery.

Affected products

cacti: through 1.2.7

References

http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00001.html
http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00005.html
http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00042.html
http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00048.html
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=947374
https://github.com/Cacti/cacti/issues/3025
https://security.gentoo.org/glsa/202003-40
https://www.darkmatter.ae/xen1thlabs/
http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00001.html
http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00005.html
http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00042.html
http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00048.html

Get alerted when CVE-2019-17357 or the next vulnerability affects your stack