CVE-2023-49084

Deeper analysis

Cacti, a performance and fault management framework that serves as a frontend to RRDTool, contains a vulnerability in the link.php component. The issue stems from a SQL injection flaw combined with insufficient validation of include file paths, which permits arbitrary code execution on the server under CWE-98. The vulnerability received a CVSS 3.1 score of 8.0 and was published in December 2023.

An authenticated user can exploit the flaw over the network to achieve remote code execution with high impact on confidentiality, integrity, and availability. The attack requires high attack complexity and administrative privileges but does not need user interaction, and the scope is changed.

Public advisories from the Cacti project, Debian, and Fedora document the issue and point to available patches and updated packages that address the SQL injection and path-handling weaknesses in link.php. Security practitioners should apply the fixes referenced in GHSA-pfh9-gwm6-86vp and the corresponding distribution announcements.

The EPSS score stands at 0.8834 with an identical recorded peak, indicating sustained exploitation interest since disclosure. Public exploit code has appeared on Packet Storm.