Insecure Direct Object Reference Vulnerability in Cacti by Cacti Group
CVE-2023-37543

7.5HIGH

Key Information:

Vendor

Cacti

Status
Cacti
Vendor
CVE Published:
10 August 2023

What is CVE-2023-37543?

Cacti versions prior to 1.2.6 are vulnerable to an Insecure Direct Object Reference (IDOR) issue that permits unauthorized users to access sensitive graphs by modifying the 'local_graph_id' parameter in the graph_xport.php file. This vulnerability enables attackers to traverse access controls and potentially extract confidential information without proper authorization.

References

https://github.com/Cacti/cacti/security/advisories/GHSA-4...
https://medium.com/%40hussainfathy99/exciting-news-my-fir...

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2023-37543 : Insecure Direct Object Reference Vulnerability in Cacti by Cacti Group