ID:8906 - Exploit for Improper Authorization in Cacti - CVE-2022-46169

Link to public exploit:

Vulnerability description

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to insufficient authorization within the Remote Agent when handling HTTP requests with a custom Forwarded-For HTTP header. A remote non-authenticated attacker can send a specially crafted HTTP request  to the affected instance and execute arbitrary OS commands on the server.

Remediation