What is CVE-2024-43363?

CVE-2024-43363 is a high-severity vulnerability in Cacti, classified under Code Injection. CVSS score: 7.2/10. Published 2024-10-07.

How severe is CVE-2024-43363?

High severity. CVSS v3 base score is 7.2 out of 10.

Is CVE-2024-43363 known to be exploited?

4 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

RCE in Cacti

CVE-2024-43363

Cacti is an open source performance and fault management framework. An admin user can create a device with a malicious hostname containing php code and repeat the installation process (completing only step 5 of the installation process is enough, no need to complete the steps before or after it) to use a php file as the cacti log file. After having the malicious hostname end up in the logs (log poisoning), one can simply go to the log file url to execute commands to achieve RCE. This issue has been addressed in version 1.2.28 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

Vulnerability class: RCE (Remote Code Execution)

EPSS: 0.356 (98.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.

Affected products

Cacti — versions < 1.2.28

Weakness classification (CWE)

CWE-94 — Code Injection

Public proof-of-concept exploits

References

security-advisories@github.com (x_refsource_CONFIRM, Exploit, Third Party Advisory)
af854a3a-2127-422b-91ae-364da2661108

Frequently asked questions

What is CVE-2024-43363?: CVE-2024-43363 is a high-severity vulnerability in Cacti, classified under Code Injection. CVSS score: 7.2/10. Published 2024-10-07.
How severe is CVE-2024-43363?: High severity. CVSS v3 base score is 7.2 out of 10.
Is CVE-2024-43363 known to be exploited?: 4 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.