CVE-2019-17358

Name of the Vulnerable Software and Affected Versions Cacti versions prior to 1.2.8

Description The issue is related to insufficient deserialization mechanisms in the lib/functions.php component of the Cacti network monitoring tool. This could allow a remote attacker to compromise data integrity or cause a denial of service. An authenticated attacker may exploit this to influence object data values and control actions taken by Cacti, potentially causing memory corruption in the PHP module.

Recommendations For Cacti versions prior to 1.2.8, update to version 1.2.8 or later to resolve the issue. As a temporary workaround, consider restricting access to the lib/functions.php component to minimize the risk of exploitation.