CVE-2023-31132: 
Cacti vulnerability analysis and mitigation

CVE-2023-31132 affects Cacti, an open source operational monitoring and fault management framework. The vulnerability was discovered in versions prior to 1.2.25 and allows privilege escalation on Windows systems. A low-privileged OS user with access to a Windows host where Cacti is installed can create arbitrary PHP files in a web document directory and execute them under the security context of SYSTEM (GitHub Advisory).

The vulnerability has a CVSS v3.1 base score of 7.8 (High) with the following vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The attack requires local access, low complexity, low privileges, and no user interaction. The scope is unchanged but impacts confidentiality, integrity, and availability at high levels (NVD).

When successfully exploited, this vulnerability allows an attacker to escalate privileges from a normal user account to SYSTEM level access on Windows systems. This gives the attacker full control over the affected system with the highest possible privileges (GitHub Advisory).

The vulnerability has been patched in Cacti version 1.2.25. Users are strongly advised to upgrade to this version or later. There are no known workarounds for this vulnerability (GitHub Advisory, Fedora Update).