The remote Debian 11 / 12 host has a package installed that is affected by multiple vulnerabilities as referenced in the dsa-5646 advisory.

    -----BEGIN PGP SIGNED MESSAGE-----     Hash: SHA512

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-5646-1                   security@debian.org     https://www.debian.org/security/                     Salvatore Bonaccorso     March 24, 2024                        https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : cacti     CVE ID         : CVE-2023-39360 CVE-2023-39513 CVE-2023-49084 CVE-2023-49085                      CVE-2023-49086 CVE-2023-49088 CVE-2023-50250 CVE-2023-50569     Debian Bug     : 1059254

    Multiple security vulnerabilities have been discovered in Cacti, a web     interface for graphing of monitoring systems, which could result in     cross-site scripting, SQL injection, or command injection.

    For the oldstable distribution (bullseye), these problems have been fixed     in version 1.2.16+ds1-2+deb11u3.

    For the stable distribution (bookworm), these problems have been fixed in     version 1.2.24+ds1-1+deb12u2.

    We recommend that you upgrade your cacti packages.

    For the detailed security status of cacti please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/cacti

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org
    -----BEGIN PGP SIGNATURE-----

    iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAmYAIe9fFIAAAAAALgAo     aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2     NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND     z0S9eQ/7ByZTgI28ry2EvqJhUj3m3sT9PtgebprbQ/bvq6osaNjTnMI1BSpn84g9     Cu2aS8ymXWm4ZDc7Kpri0SOhQM6m2G72j/7lSLpfnugTci/qZdW/yG2RQ5aL1G7H     h8IRKi395uhAWQ449T7+BDVOKxCwjfY0WdVzH2IQJP3Aa0hUb1QPLL+84pFOSFDU     GmIj/HwzK79M6q0FwaldNn3CEhiW5s1PixRY4xZtjsDP0jDqUdNTfWfazaKt+fum     GaUyoUR8hBm3IdAhyWS/j8BMquibTo0fwBCsyc54nNWeItwKLY5T5GZGxOfRte5p     60UfqKxxzNFKs5wNMdhPn5MLUmXPbmYzpf6QehYek9pMW0lr44gL1X1pJu5pEDK+     aEp+HoRbPMbMBPFjG+Pgm9s+yWNarhXcoAq01p68Ti12bvb5slGXh1Rbxm3NcQrk     uGAeNjdj3EZDb/qasEs3X3ghvLzOliz5b4pvP8S4PlZ9YD1Pdgzctj2qv4WOjvx0     K1MEZf/X9ew0phfzTuKS/xlNo9OA9bSD5r3K6GLgUc+iWFtd9SvAFM05fFkdIN9I     c7mWaa5cxxYyGYKVoxCpiO6rPz7spiUVDrf7ukjC6LkCPleWcZOkGblWWQKnw8kA     8kaicQV9LXPG6Pb+DbfpU5gLuc7DYg468bB38gNXp4L2j0a8+bM=     =uLpk
    -----END PGP SIGNATURE-----



Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Debian dsa-5646 : cacti - security update

high Nessus Plugin ID 192517

Version 1.3

Version 1.1

Version 1.0

Version 1.3 Sep 25, 2025, 3:39 PM Exploit attributes ("Exploit framework metasploit" set to "True") Plugin Feed: 202509251539
Version 1.1 Mar 25, 2024, 1:21 PM Exploit attributes ("Exploit framework metasploit" set to "True") Plugin Feed: 202403251321
Version 1.0 Mar 24, 2024, 9:42 PM New Plugin Feed: 202403242142