CVE-2023-30534 Insecure Deserialization in Cacti
Attackers could potentially execute arbitrary code via insecure deserialization in Cacti, though current gadget chains were not exploitable.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-30534?
CVE-2023-30534 is a medium-severity unsafe deserialization vulnerability in Cacti Cacti, published on 5 Sep 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Cacti is an open source operational monitoring and fault management framework. There are two instances of insecure deserialization in Cacti version 1.2.24. While a viable gadget chain exists in Cacti’s vendor directory (phpseclib), the necessary gadgets are not included, making them inaccessible and the insecure deserializations not exploitable. Each instance of insecure deserialization is due to using the unserialize function without sanitizing the user input. Cacti has a “safe” deserialization that attempts to sanitize the content and check for specific values before calling unserialize, but it isn’t used in these instances. The vulnerable code lies in graphs_new.php, specifically within the host_new_graphs_save function. This issue has been addressed in version 1.2.25. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Weakness: CWE-502
Which versions are affected by CVE-2023-30534?
It affects 2 products.
Products include Cacti Cacti, Fedoraproject Fedora.
How do I fix CVE-2023-30534?
Upgrade to a fixed version.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2023-30534 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-30534 exists.
Public exploit code: 1 Nuclei template.
Other vulnerabilities in Cacti Cacti
- CVE-2022-46169 Cacti Command Injection
- CVE-2026-39893 Cacti: Pre-authentication SQL injection via rfilter RLIKE clause in graph_view.php
- CVE-2026-39938 Cacti: Unauthenticated RCE on Graph Image
- CVE-2026-39955 Cacti has Pre-Authentication SQL Injection via unanchored FILTER_VALIDATE_REGEXP in graph_view.php
- CVE-2023-39361 Unauthenticated SQL Injection in graph_view.php in Cacti
Sources
Also known as CLEANSTART-2024-VJ51383, DEBIAN-CVE-2023-30534, GHSA-77rf-774j-6h3p, UBUNTU-CVE-2023-30534.