| ID |
CVE-2020-7237
|
| Summary |
Cacti 1.2.8 allows Remote Code Execution (by privileged users) via shell metacharacters in the Performance Boost Debug Log field of poller_automation.php. OS commands are executed when a new poller cycle begins. The attacker must be authenticated, and must have access to modify the Performance Settings of the product. |
| References |
|
| Vulnerable Configurations |
|
| CVSS |
| Base: | 5.0 |
| Impact: | |
| Exploitability: | |
|
| Access |
| Vector | Complexity | Authentication |
|
|
|
|
| Impact |
| Confidentiality | Integrity | Availability |
|
|
|
|
| Last major update |
20-01-2020 - 05:15 |
| Published |
20-01-2020 - 05:15 |
| Last modified |
21-01-2020 - 13:19 |
