← Back to CVEs
CVE-2024-31459
HIGH8.0
Description
Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, there is a file inclusion issue in the `lib/plugin.php` file. Combined with SQL injection vulnerabilities, remote code execution can be implemented. There is a file inclusion issue with the `api_plugin_hook()` function in the `lib/plugin.php` file, which reads the plugin_hooks and plugin_config tables in database. The read data is directly used to concatenate the file path which is used for file inclusion. Version 1.2.27 contains a patch for the issue.
CVE Details
CVSS v3.1 Score8.0
SeverityHIGH
CVSS VectorCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Attack VectorNETWORK
ComplexityHIGH
Privileges RequiredHIGH
User InteractionNONE
Published5/14/2024
Last Modified11/4/2025
Sourcenvd
Honeypot Sightings0
Affected Products
cacti:cactifedoraproject:fedora
Weaknesses (CWE)
CWE-98
References
https://github.com/Cacti/cacti/security/advisories/GHSA-cx8g-hvq8-p2rv(security-advisories@github.com)
https://github.com/Cacti/cacti/security/advisories/GHSA-gj3f-p326-gh8r(security-advisories@github.com)
https://github.com/Cacti/cacti/security/advisories/GHSA-pfh9-gwm6-86vp(security-advisories@github.com)
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RBEOAFKRARQHTDIYSL723XAFJ2Q6624X/(security-advisories@github.com)
https://github.com/Cacti/cacti/security/advisories/GHSA-cx8g-hvq8-p2rv(af854a3a-2127-422b-91ae-364da2661108)
https://github.com/Cacti/cacti/security/advisories/GHSA-gj3f-p326-gh8r(af854a3a-2127-422b-91ae-364da2661108)
https://github.com/Cacti/cacti/security/advisories/GHSA-pfh9-gwm6-86vp(af854a3a-2127-422b-91ae-364da2661108)
https://lists.debian.org/debian-lts-announce/2024/09/msg00027.html(af854a3a-2127-422b-91ae-364da2661108)
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RBEOAFKRARQHTDIYSL723XAFJ2Q6624X/(af854a3a-2127-422b-91ae-364da2661108)
IOC Correlations
No correlations recorded
This product uses data from the NVD API but is not endorsed or certified by the NVD.