CoreCVE
Back

MEDIUM

Cacti 1.1.27 allows remote authenticated administrators to read arbitrary files by placing the Log Path into a private directory, and then making a clog.php?filename= request, as demonstrated by filename=passwd (with a Log Path under /etc) to read /etc/passwd

Published Nov 8, 2017

Description

Cacti 1.1.27 allows remote authenticated administrators to read arbitrary files by placing the Log Path into a private directory, and then making a clog.php?filename= request, as demonstrated by filename=passwd (with a Log Path under /etc) to read /etc/passwd.

Affected products

Remediation

No remediation recorded yet.

Metrics

Weaknesses (1)

CWE-200

Exposure of Sensitive Information

References (1)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner mitre
Published Nov 8, 2017
Updated Sep 16, 2024
Reserved Nov 7, 2017
Link CVE-2017-16661
CISA Vulnrichment
Updated n/a
NVD
Status Modified
Modified Jun 17, 2026
Link CVE-2017-16661
Red Hat
Severity n/a
Public date n/a
Links CVE-2017-16661