CVE-2017-16661

CVE-2017-16661

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Cacti 1.1.27 allows remote authenticated administrators to read arbitrary files by placing the Log Path into a private directory, and then making a clog.php?filename= request, as demonstrated by filename=passwd (with a Log Path under /etc) to read /etc/passwd.

CVSS 4.9 · Medium · EPSS 1.5% · Fix available

Published

2017-11-08T05:00:00.000Z

Updated

2024-09-16T19:04:14.730Z

Stack: system

Check your server →