CVE-2019-17357
Cacti through 1.2.7 is affected by a graphs.php?template_id= SQL injection vulnerability...
Cacti through 1.2.7 is affected by a graphs.php?template_id= SQL injection vulnerability affecting how template identifiers are handled when a string and id composite value are used to identify the template type and id. An authenticated attacker can exploit this to extract data from the database, or an unauthenticated remote attacker could exploit this via Cross-Site Request Forgery.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Cacti through 1.2.7 is affected by a graphs.php?template_id= SQL injection vulnerability affecting how template identifiers are handled when a string and id composite value are used to identify the template type and id. An authenticated attacker can exploit this to extract data from the database, or an unauthenticated remote attacker could exploit this via Cross-Site Request Forgery.
- Record
CVE-2019-17357- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - CVSS 2.0
- 4.0 Medium
AV:N/AC:L/Au:S/C:P/I:N/A:N - Weakness
- CWE-89
- Updated
- 2026-11-02
CVE List No score
Cacti through 1.2.7 is affected by a graphs.php?template_id= SQL injection vulnerability affecting how template identifiers are handled when a string and id composite value are used to identify the template type and id. An authenticated attacker can exploit this to extract data from the database, or an unauthenticated remote attacker could exploit this via Cross-Site Request Forgery.
- Record
CVE-2019-17357- Updated
- 2026-11-02
EUVDEUVD-2019-7767 No score
Cacti through 1.2.7 is affected by a graphs.php?template_id= SQL injection vulnerability affecting how template identifiers are handled when a string and id composite value are used to identify the template type and id. An authenticated attacker can exploit this to extract data from the database, or an unauthenticated remote attacker could exploit this via Cross-Site Request Forgery.
- Record
EUVD-2019-7767- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-mxrx-hwh2-j2jm No score
Cacti through 1.2.7 is affected by a graphs.php?template_id= SQL injection vulnerability...
Cacti through 1.2.7 is affected by a graphs.php?template_id= SQL injection vulnerability affecting how template identifiers are handled when a string and id composite value are used to identify the template type and id. An authenticated attacker can exploit this to extract data from the database, or an unauthenticated remote attacker could exploit this via Cross-Site Request Forgery.
- Record
GHSA-mxrx-hwh2-j2jm- Updated
- 2026-11-02
OSV
Cacti through 1.2.7 is affected by a graphs.php?template_id= SQL injection vulnerability affecting how template identifiers are handled when a string and id composite value are used to identify the template type and id. An authenticated attacker can exploit this to extract data from the database, or an unauthenticated remote attacker could exploit this via Cross-Site Request Forgery.
- Record
CVE-2019-17357- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2019-17357
Cacti through 1.2.7 is affected by a graphs.php?template_id= SQL injection vulnerability affecting how template identifiers are handled when a string and id composite value are used to identify the template type and id. An authenticated attacker can exploit this to extract data from the database, or an unauthenticated remote attacker could exploit this via Cross-Site Request Forgery.
- Record
DEBIAN-CVE-2019-17357- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
Show 6 moreShow less
OSVUBUNTU-CVE-2019-17357
Cacti through 1.2.7 is affected by a graphs.php?template_id= SQL injection vulnerability affecting how template identifiers are handled when a string and id composite value are used to identify the template type and id. An authenticated attacker can exploit this to extract data from the database, or an unauthenticated remote attacker could exploit this via Cross-Site Request Forgery.
- Record
UBUNTU-CVE-2019-17357- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVopenSUSE-SU-2020:0272-1 No score
Security update for cacti, cacti-spine
This update for cacti, cacti-spine fixes the following issues:
cacti-spine was updated to version 1.2.9.
Security issues fixed:
- CVE-2009-4112: Fixed a privilege escalation (bsc#1122535).
- CVE-2018-20723: Fixed a cross-site scripting (XSS) vulnerability (bsc#1122245).
- CVE-2018-20724: Fixed a cross-site scripting (XSS) vulnerability (bsc#1122244).
- CVE-2018-20725: Fixed a privilege escalation that could occur under certain conditions (bsc#1122535).
- CVE-2018-20726: Fixed a cross-site scripting (XSS) vulnerability (bsc#1122242).
- CVE-2019-16723: Fixed an authentication bypass vulnerability.
- CVE-2019-17357: Fixed an SQL injection vulnerability (bsc#1158990).
- CVE-2019-17358: Fixed an unsafe deserialization in sanitize_unserialize_selected_items (bsc#1158992).
- CVE-2020-7106: Fixed a potential cross-site scripting (XSS) vulnerability (bsc#1163749).
- CVE-2020-7237: Fixed a remote code execution that affected privileged users via shell metacharacters in the Performance Boost Debug Log field (bsc#1161297).
Non-security issues fixed:
- Fixed missing packages php-json, php-ctype, and php-gd in cacti.spec (boo#1101024).
- Fixed Apache2.4 and Apache2.2 runtime configuration issue (boo#1101139).
- Record
openSUSE-SU-2020:0272-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2020:0284-1 No score
Security update for cacti, cacti-spine
This update for cacti, cacti-spine fixes the following issues:
cacti-spine was updated to version 1.2.9.
Security issues fixed:
- CVE-2009-4112: Fixed a privilege escalation (bsc#1122535).
- CVE-2018-20723: Fixed a cross-site scripting (XSS) vulnerability (bsc#1122245).
- CVE-2018-20724: Fixed a cross-site scripting (XSS) vulnerability (bsc#1122244).
- CVE-2018-20725: Fixed a privilege escalation that could occur under certain conditions (bsc#1122535).
- CVE-2018-20726: Fixed a cross-site scripting (XSS) vulnerability (bsc#1122242).
- CVE-2019-16723: Fixed an authentication bypass vulnerability.
- CVE-2019-17357: Fixed an SQL injection vulnerability (bsc#1158990).
- CVE-2019-17358: Fixed an unsafe deserialization in sanitize_unserialize_selected_items (bsc#1158992).
- CVE-2020-7106: Fixed a potential cross-site scripting (XSS) vulnerability (bsc#1163749).
- CVE-2020-7237: Fixed a remote code execution that affected privileged users via shell metacharacters in the Performance Boost Debug Log field (bsc#1161297).
Non-security issues fixed:
- Fixed missing packages php-json, php-ctype, and php-gd in cacti.spec (boo#1101024).
- Fixed Apache2.4 and Apache2.2 runtime configuration issue (boo#1101139).
This update was imported from the openSUSE:Leap:15.1:Update update project.
- Record
openSUSE-SU-2020:0284-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2020:0558-1 No score
Security update for cacti, cacti-spine
This update for cacti, cacti-spine to version 1.2.11 fixes the following issues:
This update is fixing multiple vulnerabilities and adding bug fixes. For more details consult the changes file.
- Record
openSUSE-SU-2020:0558-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2020:0565-1 No score
Security update for cacti, cacti-spine
This update for cacti, cacti-spine to version 1.2.11 fixes the following issues:
This update is fixing multiple vulnerabilities and adding bug fixes. For more details consult the changes file.
This update was imported from the openSUSE:Leap:15.1:Update update project.
- Record
openSUSE-SU-2020:0565-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10670-1 No score
cacti-1.2.18-1.2 on GA media
These are all security issues fixed in the cacti-1.2.18-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10670-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
cactiDebian:12 |
before 1.2.8+ds1-1 | 1.2.8+ds1-1 |
cactiDebian:13 |
before 1.2.8+ds1-1 | 1.2.8+ds1-1 |
cactiDebian:14 |
before 1.2.8+ds1-1 | 1.2.8+ds1-1 |
cactiUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 0.8.8b+dfsg-30.8.8b+dfsg-50.8.8b+dfsg-5ubuntu0.10.8.8b+dfsg-5ubuntu0.20.8.8b+dfsg-5ubuntu0.2+esm10.8.8b+dfsg-5ubuntu0.2+esm2 |
None known |
cactiUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 0.8.8f+ds1-20.8.8f+ds1-30.8.8f+ds1-40.8.8f+ds1-4ubuntu10.8.8f+ds1-4ubuntu2 Show 7 moreShow less0.8.8f+ds1-4ubuntu30.8.8f+ds1-4ubuntu40.8.8f+ds1-4ubuntu4.16.040.8.8f+ds1-4ubuntu4.16.04.10.8.8f+ds1-4ubuntu4.16.04.20.8.8f+ds1-4ubuntu4.16.04.2+esm10.8.8f+ds1-4ubuntu4.16.04.2+esm2 |
None known |
cactiUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 1.1.18+ds1-11.1.27+ds1-21.1.27+ds1-31.1.28+ds1-21.1.35+ds1-1 Show 5 moreShow less1.1.36+ds1-11.1.38+ds1-11.1.38+ds1-1ubuntu0.1~esm11.1.38+ds1-1ubuntu0.1~esm31.1.38+ds1-1ubuntu0.1~esm4 |
None known |
cactiopenSUSE:Leap 15.1 From an advisory covering 10 CVEs |
before 1.2.9-lp151.3.3.1 | 1.2.9-lp151.3.3.1 |
cacti-spineopenSUSE:Leap 15.1 From an advisory covering 10 CVEs |
before 1.2.9-lp151.3.3.1 | 1.2.9-lp151.3.3.1 |
cactiSUSE:Package Hub 15 SP1 From an advisory covering 10 CVEs |
before 1.2.9-bp151.4.3.1 | 1.2.9-bp151.4.3.1 |
cacti-spineSUSE:Package Hub 15 SP1 From an advisory covering 10 CVEs |
before 1.2.9-bp151.4.3.1 | 1.2.9-bp151.4.3.1 |
Show 7 moreShow less
| Package | Affected | Fixed |
|---|---|---|
cactiSUSE:Package Hub 12 From an advisory covering 11 CVEs |
before 1.2.11-5.1 | 1.2.11-5.1 |
cacti-spineSUSE:Package Hub 12 From an advisory covering 11 CVEs |
before 1.2.11-2.1 | 1.2.11-2.1 |
cactiopenSUSE:Leap 15.1 From an advisory covering 11 CVEs |
before 1.2.11-5.1 | 1.2.11-5.1 |
cacti-spineopenSUSE:Leap 15.1 From an advisory covering 11 CVEs |
before 1.2.11-2.1 | 1.2.11-2.1 |
cactiSUSE:Package Hub 15 SP1 From an advisory covering 11 CVEs |
before 1.2.11-bp151.4.6.1 | 1.2.11-bp151.4.6.1 |
cacti-spineSUSE:Package Hub 15 SP1 From an advisory covering 11 CVEs |
before 1.2.11-bp151.4.6.1 | 1.2.11-bp151.4.6.1 |
cactiopenSUSE:Tumbleweed From an advisory covering 31 CVEs |
before 1.2.18-1.2 | 1.2.18-1.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-17357 is a medium vulnerability (CVSS 6.5) in Cacti, published January 21, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 34.2%, the 98th percentile. Fixed in cacti 1.2.8+ds1-1.
References
darkmatter.ae/xen1thlabs
github.com/Cacti/cacti/issues/3025
bugs.debian.org/cgi-bin/bugreport.cgi?bug=947374
lists.opensuse.org/opensuse-security-announce/2020-03/msg00001.html
security.gentoo.org/glsa/202003-40
Show 57 moreShow less
nvd.nist.gov/vuln/detail/CVE-2019-17357
security-tracker.debian.org/tracker/CVE-2019-17357
ubuntu.com/security/CVE-2019-17357
cve.org/CVERecord?id=CVE-2019-17357
bugzilla.suse.com/1082318
suse.com/security/cve/CVE-2009-4112