CVE-2016-3172
Publication date 12 April 2016
Last updated 17 July 2025
Ubuntu priority
Description
SQL injection vulnerability in tree.php in Cacti 0.8.8g and earlier allows remote authenticated users to execute arbitrary SQL commands via the parent_id parameter in an item_edit action.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| cacti | ||
| 16.04 LTS xenial |
Fixed 0.8.8f+ds1-4ubuntu4.16.04.2
|
|
| 14.04 LTS trusty |
Fixed 0.8.8b+dfsg-5ubuntu0.2
|
|
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score |
8.8 · High
|
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | Low |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality | High |
| Integrity impact | High |
| Availability impact | High |
| Vector | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |