CVE-2015-4342
SQL injection vulnerability in Cacti before 0.8.8d allows remote attackers to execute arbitrary...
SQL injection vulnerability in Cacti before 0.8.8d allows remote attackers to execute arbitrary SQL commands via unspecified vectors involving a cdef id.
Exploit likelihood
What each source reports
NVD Score used
SQL injection vulnerability in Cacti before 0.8.8d allows remote attackers to execute arbitrary SQL commands via unspecified vectors involving a cdef id.
- Record
CVE-2015-4342- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-89
- Updated
- 2026-11-02
CVE List No score
SQL injection vulnerability in Cacti before 0.8.8d allows remote attackers to execute arbitrary SQL commands via unspecified vectors involving a cdef id.
- Record
CVE-2015-4342- Updated
- 2026-11-02
EUVDEUVD-2015-4365 No score
SQL injection vulnerability in Cacti before 0.8.8d allows remote attackers to execute arbitrary SQL commands via unspecified vectors involving a cdef id.
- Record
EUVD-2015-4365- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-v774-w7w7-mvrg No score
SQL injection vulnerability in Cacti before 0.8.8d allows remote attackers to execute arbitrary...
SQL injection vulnerability in Cacti before 0.8.8d allows remote attackers to execute arbitrary SQL commands via unspecified vectors involving a cdef id.
- Record
GHSA-v774-w7w7-mvrg- Weakness
- CWE-89
- Updated
- 2026-11-02
OSV No score
SQL injection vulnerability in Cacti before 0.8.8d allows remote attackers to execute arbitrary SQL commands via unspecified vectors involving a cdef id.
- Record
CVE-2015-4342- Updated
- 2026-11-02
OSVDEBIAN-CVE-2015-4342 No score
SQL injection vulnerability in Cacti before 0.8.8d allows remote attackers to execute arbitrary SQL commands via unspecified vectors involving a cdef id.
- Record
DEBIAN-CVE-2015-4342- Updated
- 2026-11-02
OSVMGASA-2015-0306 No score
Updated cacti package fixes security vulnerability
Cross-site scripting (XSS) vulnerability in Cacti before 0.8.8d allows remote attackers to inject arbitrary web script or HTML via unspecified vectors (CVE-2015-2665).
SQL injection vulnerability in Cacti before 0.8.8d allows remote attackers to execute arbitrary SQL commands via unspecified vectors involving a cdef id (CVE-2015-4342).
SQL injection vulnerability in the get_hash_graph_template function in lib/functions.php in Cacti before 0.8.8d allows remote attackers to execute arbitrary SQL commands via the graph_template_id parameter to graph_templates.php (CVE-2015-4454).
SQL injection vulnerability in Cacti before 0.8.8e in graphs.php (CVE-2015-4634).
The cacti package has been updated to version 0.8.8e, which fixes this issue, as well as other SQL injection and XSS issues and other bugs
- Record
MGASA-2015-0306- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10084-1 No score
cacti-0.8.8h-1.2 on GA media
These are all security issues fixed in the cacti-0.8.8h-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10084-1- Updated
- 2026-11-02
OSVUBUNTU-CVE-2015-4342 No score
SQL injection vulnerability in Cacti before 0.8.8d allows remote attackers to execute arbitrary SQL commands via unspecified vectors involving a cdef id.
- Record
UBUNTU-CVE-2015-4342- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
cactiDebian:12 |
before 0.8.8d+ds1-1 | 0.8.8d+ds1-1 |
cactiDebian:13 |
before 0.8.8d+ds1-1 | 0.8.8d+ds1-1 |
cactiDebian:14 |
before 0.8.8d+ds1-1 | 0.8.8d+ds1-1 |
cactiDebian:6.0 From an advisory covering 4 CVEs |
before 0.8.7g-1+squeeze6, plus listed versions 0.8.7g-10.8.7g-1+squeeze10.8.7g-1+squeeze20.8.7g-1+squeeze30.8.7g-1+squeeze40.8.7g-1+squeeze5 |
0.8.7g-1+squeeze6 |
cactiDebian:7 From an advisory covering 4 CVEs |
before 0.8.8a+dfsg-5+deb7u5, plus listed versions 0.8.8a+dfsg-50.8.8a+dfsg-5+deb7u10.8.8a+dfsg-5+deb7u20.8.8a+dfsg-5+deb7u30.8.8a+dfsg-5+deb7u4 |
0.8.8a+dfsg-5+deb7u5 |
cactiDebian:8 From an advisory covering 4 CVEs |
before 0.8.8b+dfsg-8+deb8u1, plus listed versions 0.8.8b+dfsg-8 |
0.8.8b+dfsg-8+deb8u1 |
cactiMageia:4 From an advisory covering 4 CVEs |
before 0.8.8f-1.mga4 | 0.8.8f-1.mga4 |
cactiMageia:5 From an advisory covering 4 CVEs |
before 0.8.8f-1.mga5 | 0.8.8f-1.mga5 |
cactiUbuntu:14.04:LTS |
before 0.8.8b+dfsg-5ubuntu0.1, plus listed versions 0.8.8b+dfsg-30.8.8b+dfsg-5 |
0.8.8b+dfsg-5ubuntu0.1 |
cactiopenSUSE:Tumbleweed From an advisory covering 18 CVEs |
before 0.8.8h-1.2 | 0.8.8h-1.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2015-4342 is a high vulnerability (CVSS 7.5) in Cacti, published June 17, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.20%, the 88th percentile. Fixed in cacti 0.8.8d+ds1-1.
References
bugzilla.suse.com/show_bug.cgi?id=934187
lists.opensuse.org/opensuse-updates/2015-06/msg00052.html
lists.fedoraproject.org/pipermail/package-announce/2016-May/183449.html
suse.com/security/cve/CVE-2015-4342.html
packetstormsecurity.com/files/132224/Cacti-SQL-Injection-Header-Injection.html
cacti.net/release_notes_0_8_8d.php
Show 35 moreShow less
bugs.cacti.net/view.php?id=2571
securitytracker.com/id/1032672
securityfocus.com/bid/75108
debian.org/security/2015/dsa-3295
seclists.org/fulldisclosure/2015/Jun/19
nvd.nist.gov/vuln/detail/CVE-2015-4342
github.com/advisories/GHSA-v774-w7w7-mvrg
security-tracker.debian.org/tracker/CVE-2015-4342
advisories.mageia.org/MGASA-2015-0306.html
bugs.mageia.org/show_bug.cgi?id=16202
ubuntu.com/security/CVE-2015-4342
svn.cacti.net/viewvc?view=rev&revision=7719
cve.org/CVERecord?id=CVE-2015-4342