CVE-2017-16661

Cacti 1.1.27 allows remote authenticated administrators to read arbitrary files by placing the Log Path into a private directory, and then making a clog.php?filename= request, as demonstrated by filename=passwd (with a Log Path under /etc) to read /etc/passwd.
References
Link Resource
https://github.com/Cacti/cacti/issues/1066 Exploit Issue Tracking Patch
Configurations

Configuration 1 (hide)

cpe:2.3:a:cacti:cacti:1.1.27:*:*:*:*:*:*:*

History

No history.

Information

Published : 2017-11-08 05:29

Updated : 2024-02-04 19:29


NVD link : CVE-2017-16661

Mitre link : CVE-2017-16661

CVE.ORG link : CVE-2017-16661


JSON object : View

Products Affected

cacti

  • cacti
CWE
CWE-200

Exposure of Sensitive Information to an Unauthorized Actor