CVE-2023-39358

Summary

CVE-2023-39358 is a newly discovered vulnerability affecting the open source monitoring tool, Cacti. The issue lies in the `reports_user.php` file, specifically in the `ajax_get_branches` function. Authenticated users can exploit an SQL injection vulnerability in this function to gain privilege escalation and execute remote code. The root cause is the lack of validation for the `tree_id` parameter. Upgrading to version 1.2.25 is recommended to address this vulnerability. No known workarounds exist.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.