Unscored severity · published Oct 25, 2012
CVE-2011-5223
Cross-site request forgery (CSRF) vulnerability in logout.php in Cacti before 0.8.7i allows remote attackers to hijack the authentication of unspecified victims via unknown…
–
CVSS
2.1%
EPSS
No
On KEV
Description
Cross-site request forgery (CSRF) vulnerability in logout.php in Cacti before 0.8.7i allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.1% · higher than 82% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CA
Cacti · Cacti
through 0.8.7h; 0.5; 0.6; 0.6.1; 0.6.2; 0.6.3; +33 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2011-5223
CVE.org
https://www.cve.org/CVERecord?id=CVE-2011-5223
bugs.cacti.net
http://bugs.cacti.net/view.php?id=2062
forums.cacti.net
http://forums.cacti.net/viewtopic.php?f=21&t=44116
forums.cacti.net
http://forums.cacti.net/viewtopic.php?f=4&t=45871
Vendor Advisory
http://secunia.com/advisories/47195
www.securityfocus.com
http://www.securityfocus.com/bid/51048
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/71792
More from Cacti
9.8
CVE-2022-46169
Unauthenticated Command Injection
10.0
CVE-2024-29895
Cacti command injection in cmd_realtime.php
9.8
CVE-2026-40079
Cacti: Command Injection via escape_command() no-op in RRDtool execution
9.8
CVE-2026-39948
Cacti has SQL Injection via rfilter parameter in RLIKE clauses
9.8
CVE-2026-39955
Cacti has Pre-Authentication SQL Injection via unanchored FILTER_VALIDATE_REGEXP in graph_view.php