CVE-2017-16661

MEDIUM

Cacti 1.1.27 - Authenticated Arbitrary File Read via clog.php Log Path Manipulation

Title source: llm
STIX 2.1

Description

Cacti 1.1.27 allows remote authenticated administrators to read arbitrary files by placing the Log Path into a private directory, and then making a clog.php?filename= request, as demonstrated by filename=passwd (with a Log Path under /etc) to read /etc/passwd.

References (1)

Core 1
Core References
Exploit, Issue Tracking, Patch x_refsource_misc
https://github.com/Cacti/cacti/issues/1066

Scores

CVSS v3 4.9
EPSS 0.0147
EPSS Percentile 70.6%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Details

CWE
CWE-200
Status published
Products (1)
cacti/cacti 1.1.27
Published Nov 08, 2017
Tracked Since Feb 18, 2026