CVE-2019-17357

Name of the Vulnerable Software and Affected Versions Cacti versions prior to 1.2.8

Description The issue affects how template identifiers are handled in Cacti when a string and a composite id value are used. This can be exploited by an authenticated attacker to extract data from the database. Additionally, an unauthenticated remote attacker could exploit this via a Cross-Site Request Forgery attack. The vulnerability is related to the template id function in the graphs.php file.

Recommendations For versions prior to 1.2.8, update to version 1.2.8 or later to resolve the issue. As a temporary workaround, consider restricting access to the graphs.php file and the template id parameter to minimize the risk of exploitation.