CVE-2015-4454

Publication date 17 June 2015

Last updated 24 July 2024

Ubuntu priority

Description

SQL injection vulnerability in the get_hash_graph_template function in lib/functions.php in Cacti before 0.8.8d allows remote attackers to execute arbitrary SQL commands via the graph_template_id parameter to graph_templates.php.

Status

Show unmaintained releases

Package	Ubuntu Release	Status
cacti	17.04 zesty	Not affected
	16.10 yakkety	Not affected
	16.04 LTS xenial	Not affected
	15.10 wily	Not affected
	15.04 vivid	Fixed 0.8.8b+dfsg-8+deb8u1build0.15.04.1
	14.10 utopic	Fixed 0.8.8b+dfsg-8+deb8u1build0.14.10.1
	14.04 LTS trusty	Fixed 0.8.8b+dfsg-5ubuntu0.1
	12.04 LTS precise	Ignored end of life

How can I get the fixes?
What do statuses mean?

References

MITRE
NVD
Launchpad
Debian

Other references

http://www.cacti.net/release_notes_0_8_8d.php
http://bugs.cacti.net/view.php?id=2572
https://www.cve.org/CVERecord?id=CVE-2015-4454