CVE-2017-16661

Cacti 1.1.27 allows remote authenticated administrators to read arbitrary files by placing the Log Path into a private directory, and then making a clog.php?filename= request, as demonstrated by filename=passwd (with a Log Path under /etc) to read /etc/passwd.
References
Link Resource
https://github.com/Cacti/cacti/issues/1066 Exploit Issue Tracking Patch
Advertisement

NeevaHost hosting service

Configurations

Configuration 1 (hide)

cpe:2.3:a:cacti:cacti:1.1.27:*:*:*:*:*:*:*

Information

Published : 2017-11-07 21:29

Updated : 2017-11-28 09:26


NVD link : CVE-2017-16661

Mitre link : CVE-2017-16661


JSON object : View

CWE
CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

Advertisement

dedicated server usa

Products Affected

cacti

  • cacti