Bug 2237613 (CVE-2023-39365)

Summary:	CVE-2023-39365 cacti: SQL Injection when using regular expressions
Product:	[Other] Security Response	Reporter:	Avinash Hanwate <ahanwate>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	Keywords:	Security
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2237614, 2237615
Bug Blocks:

Description Avinash Hanwate 2023-09-06 05:29:25 UTC

Cacti is an open source operational monitoring and fault management framework. Issues with Cacti Regular Expression validation combined with the external links feature can lead to limited SQL Injections and subsequent data leakage. This issue has been addressed in version 1.2.25. Users are advised to upgrade. There are no known workarounds for this vulnerability.



https://github.com/Cacti/cacti/security/advisories/GHSA-v5w7-hww7-2f22

Comment 1 Avinash Hanwate 2023-09-06 05:29:48 UTC

Created cacti tracking bugs for this issue:

Affects: epel-all [bug 2237614]
Affects: fedora-all [bug 2237615]