CVE-2004-1737

Description

SQL injection vulnerability in auth_login.php in Cacti 0.8.5a allows remote attackers to execute arbitrary SQL commands and bypass authentication via the (1) username or (2) password parameters.

How to fix CVE-2004-1737

To remediate CVE-2004-1737, upgrade the affected package to a fixed version below.

• Debian/cacti—upgrade to 0.8.5a-5 or later

Is CVE-2004-1737 being exploited?

Low — EPSS is 3.2%, meaning exploitation activity has not been observed at scale.

Affected packages (1)

• from 0, < 0.8.5a-5

References (1)

• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2004-1737