Cacti is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements to the tree.php script using the parent_id parameter, which could allow the attacker to view, add, modify or delete information in the back-end database. A remote attacker could send specially-crafted SQL statements to the graph_view.php script, which could allow the attacker to view, add, modify or delete information in the back-end database.
Relevant CVE Information:
CVE-ID: CVE-2016-3172
DESCRIPTION: Cacti is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements to the tree.php script using the parent_id parameter, which could allow the attacker to view, add, modify or delete information in the back-end database.
CVSS Base Score: 6.5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/111681 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)_
_
CVE-ID: CVE-2016-3659
DESCRIPTION: Cacti is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements to the graph_view.php script, which could allow the attacker to view, add, modify or delete information in the back-end database.
CVSS Base Score: 6.5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/111978 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)_
_
IBM Platform RTM 8.3, 9.1.x
Fixed in IBM Spectrum LSF RTM (formerly IBM Platform RTM) 10.1 to be released on IBM Passport Advantage
For RTM version 8.3.x, 9.1.x, IBM recommends upgrading to IBM Spectrum LSF RTM 10.1 which is available from IBM Passport Advantage
None
Upgrade to 10.1 on IBM Passport Advantage
CPE | Name | Operator | Version |
---|---|---|---|
platform rtm | eq | 8.3.0 | |
platform rtm | eq | 9.1.0 | |
platform rtm | eq | 9.1.2 | |
platform rtm | eq | 9.1.3 | |
platform rtm | eq | 9.1.4 | |
ibm spectrum lsf rtm | eq | 10.1 |