Back to Database
Status published
Medium
CVE-2023-39365
Unchecked regular expressions can lead to SQL Injection and data leakage in Cacti
Vulnerability Description
Cacti is an open source operational monitoring and fault management framework. Issues with Cacti Regular Expression validation combined with the external links feature can lead to limited SQL Injections and subsequent data leakage. This issue has been addressed in version 1.2.25. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-39365
Credits & Attribution
No credits recorded in the NVD database.
References
- https://github.com/Cacti/cacti/security/advisories/GHSA-v5w7-hww7-2f22
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WZGB2UXJEUYWWA6IWVFQ3ZTP22FIHMGN/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CFH3J2WVBKY4ZJNMARVOWJQK6PSLPHFH/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WOQFYGLZBAWT4AWNMO7DU73QXWPXTCKH/
- https://www.debian.org/security/2023/dsa-5550
- https://lists.debian.org/debian-lts-announce/2024/03/msg00018.html
More from Cacti
View All →CVE-2025-66399
SNMP Command Injection leads to RCE in Cacti
High
7.4
CVE-2025-26520
Cacti through 1.2.29 allows SQL injection in the template function...
High
7.6
CVE-2025-24368
Cacti has a SQL Injection vulnerability when using tree rules through Automation API
Medium
6.9
CVE-2025-24367
Cacti allows Arbitrary File Creation leading to RCE
High
8.7
CVE-2025-22604
Cacti has Authenticated RCE via multi-line SNMP responses
Critical
9.1
Affected Vendor
Cacti
View all reports →Affected Software
cacti
Vulnerable Versions:
< 1.2.25
Timeline
Official Publish:
September 5th, 2023
Last Modified:
February 13th, 2025
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L