CVE-2019-17358

Cacti through 1.2.7 is affected by multiple instances of lib/functions.php unsafe deserialization of user-controlled data to populate arrays. An authenticated attacker could use this to influence object data values and control actions taken by Cacti or potentially cause memory corruption in the PHP module.

Link	Resource
https://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-17358.html	Third Party Advisory
https://github.com/Cacti/cacti/blob/79f29cddb5eb05cbaff486cd634285ef1fed9326/lib/functions.php#L3109	Exploit Third Party Advisory
https://github.com/Cacti/cacti/issues/3026	Issue Tracking Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/12/msg00014.html	Mailing List Third Party Advisory
https://github.com/Cacti/cacti/commit/adf221344359f5b02b8aed43dfb6b33ae5d708c8	Product Third Party Advisory
https://www.darkmatter.ae/xen1thlabs/	Not Applicable
https://bugzilla.suse.com/show_bug.cgi?id=CVE-2019-17358	Issue Tracking Third Party Advisory
https://www.debian.org/security/2020/dsa-4604
https://seclists.org/bugtraq/2020/Jan/25
http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00001.html
http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00005.html
https://security.gentoo.org/glsa/202003-40
http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00042.html
http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00048.html

Configuration 1

cpe:2.3:a:cacti:cacti:*:*:*:*:*:*:*:* cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* cpe:2.3:o:opensuse:leap:42.3:*:*:*:*:*:*:*

---

Published : 2019-12-12 02:15

Updated : 2020-08-24 05:37

---

NVD link : CVE-2019-17358

Mitre link : CVE-2019-17358

No products.

CWE-502

Deserialization of Untrusted Data

CWE-787