CVE-2016-3172
Publication date 12 April 2016
Last updated 17 July 2025
Ubuntu priority
Description
SQL injection vulnerability in tree.php in Cacti 0.8.8g and earlier allows remote authenticated users to execute arbitrary SQL commands via the parent_id parameter in an item_edit action.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| cacti | ||
| 16.04 LTS xenial |
Fixed 0.8.8f+ds1-4ubuntu4.16.04.2
|
|
| 14.04 LTS trusty |
Fixed 0.8.8b+dfsg-5ubuntu0.2
|
|
Severity score breakdown
CVSS version: CVSS v3.0
Base score
8.8 · High
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H