Vulnerability CVE-2019-16723: Information

Description

In Cacti through 1.2.6, authenticated users may bypass authorization checks (for viewing a graph) via a direct graph_json.php request with a modified local_graph_id parameter.

Severity: MEDIUM (4.3) Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

URL: https://nvd.nist.gov/vuln/detail/CVE-2019-16723
Published: Sept. 23, 2019
Modified: Nov. 7, 2023
Error type identifier: CWE-639

Fixed packages

Package name
Branch
Fixed in version
Version from repository
Errata ID
Task #
State
cactisisyphus1.2.10-alt11.2.26-alt1ALT-PU-2020-1488-1247881Fixed
cactip101.2.10-alt11.2.26-alt1ALT-PU-2020-1488-1247881Fixed
cactip91.2.15-alt31.2.15-alt3ALT-PU-2020-3430-1262340Fixed
cactic10f11.2.10-alt11.2.26-alt1ALT-PU-2020-1488-1247881Fixed

References to Advisories, Solutions, and Tools

Hyperlink
Resource
https://github.com/Cacti/cacti/issues/2964
  • Patch
  • Third Party Advisory
DSA-4604
    20200120 [SECURITY] [DSA 4604-1] cacti security update
      openSUSE-SU-2020:0272
        openSUSE-SU-2020:0284
          GLSA-202003-40
            openSUSE-SU-2020:0558
              openSUSE-SU-2020:0565
                FEDORA-2019-6bf27b45b3
                  FEDORA-2019-362f0e9710

                      1. Configuration 1

                        cpe:2.3:a:cacti:cacti:*:*:*:*:*:*:*:*
                        End including
                        1.2.6
                    VKontakte|Telegram|YouTube|Forum|GitHub|Bugzilla
                    Version: v24.5.0
                    Back to top