VulnSocial

CVE-2023-39361(cacti / cacti)

LOWCVSS 9.8 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a SQL injection discovered in graph_view.php. Since guest users can access graph_view.php without authentication by default, if guest users are being utilized in an enabled state, there could be the potential for significant damage. Attackers may exploit this vulnerability, and there may be possibilities for actions such as the usurpation of administrative privileges or remote code execution. This issue has been addressed in version 1.2.25. Users are advised to upgrade. There are no known workarounds for this vulnerability.

cacti CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Exploit / PoC references
Other references
Weakness type (CWE)
CWE-89

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • cacti
  • fedora

Threat summary

  • 1 mentions across 1 observed day

What's happening

  • 1 total mentions across 1 day

Affected systems

Vendors
cactifedoraproject
Products
cactifedora

3 versions affected across 2 products

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-11-01: 111-01
Referenced assets1 URL
Full discourse1 post
  • NewNormal Security@NewScanTeam

    NewNormal Security turns CVEs since the previous batch into new detections, every day. 𝗗𝗮𝗶𝗹𝘆 𝗖𝗩𝗘 𝗥𝗲𝗽𝗼𝗿𝘁 — 1 Nov 2026 𝗔𝗱𝗱𝗲𝗱 to NewScan 𝘁𝗼𝗱𝗮𝘆: 🚨 Outdated Cacti build — unauthenticated command injection on a monitoring server, exploited in the wild (Cacti CVE-2022-46169, CVE-2023-39361, CVE-2025-24367) 🔎 Zabbix fingerprint and version — read from an API call that needs no login, so Zabbix advisories can be matched to the build 🔎 pgAdmin fingerprint — a Postgres admin console identified on the public side of the perimeter Test your stack with NewScan — free, self-hosted: https://newnormalsecurity.com/newscan?utm_source=x&utm_medium=social&utm_campaign=daily-cve #infosec #AppSec #VersionDisclosure #CSO #REDTEAM

    00000151
    6 followersView on X
CPE platform detail3 entries

3 of 3 entries

PartVendorProductVersionTarget SWTarget HW
Appcacticacti1.2.24--
OSfedoraprojectfedora37--
OSfedoraprojectfedora38--

Explore more

Back to dashboardcacti CVEsfedoraproject CVEscacti vulnerabilities