CVE-2015-8377

EUVD-2015-8260
SQL injection vulnerability in the host_new_graphs_save function in graphs_new.php in Cacti 0.8.8f and earlier allows remote authenticated users to execute arbitrary SQL commands via crafted serialized data in the selected_graphs_array parameter in a save action.
SQL Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.5 UNKNOWN
NETWORK
LOW
AV:N/AC:L/Au:S/C:P/I:P/A:P
Base Score
CVSS 3.x
EPSS Score
Percentile: 55%
Affected Products (NVD)
VendorProductVersion
cacticacti
𝑥
≤ 0.8.8f
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
cacti
bookworm
1.2.24+ds1-1+deb12u4
fixed
bookworm (security)
1.2.24+ds1-1+deb12u2
fixed
bullseye
1.2.16+ds1-2+deb11u3
fixed
bullseye (security)
1.2.16+ds1-2+deb11u4
fixed
sid
1.2.28+ds1-2
fixed
trixie
1.2.28+ds1-2
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
cacti
precise
ignored
trusty
Fixed 0.8.8b+dfsg-5ubuntu0.2
released
vivid
ignored
wily
ignored
xenial
not-affected
yakkety
not-affected
zesty
not-affected
Common Weakness Enumeration
References
http://seclists.org/fulldisclosure/2015/Dec/57
http://www.debian.org/security/2016/dsa-3494
http://www.securitytracker.com/id/1034498
https://security.gentoo.org/glsa/201607-05
http://seclists.org/fulldisclosure/2015/Dec/57
http://www.debian.org/security/2016/dsa-3494
http://www.securitytracker.com/id/1034498
https://security.gentoo.org/glsa/201607-05