Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2020-8813
Vulnerability from cvelistv5
Published
2020-02-22 00:00
Modified
2024-08-04 10:12
Severity ?
EPSS score ?
Summary
graph_realtime.php in Cacti 1.2.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in a cookie, if a guest user has the graph real-time privilege.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T10:12:10.614Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://gist.github.com/mhaskar/ebe6b74c32fd0f7e1eedf1aabfd44129"
},
{
"tags": [
"x_transferred"
],
"url": "https://drive.google.com/file/d/1A8hxTyk_NgSp04zPX-23nPbsSDeyDFio/view"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/Cacti/cacti/releases"
},
{
"tags": [
"x_transferred"
],
"url": "https://shells.systems/cacti-v1-2-8-authenticated-remote-code-execution-cve-2020-8813/"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/Cacti/cacti/issues/3285"
},
{
"tags": [
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/156538/Cacti-1.2.8-Authenticated-Remote-Code-Execution.html"
},
{
"tags": [
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/156537/Cacti-1.2.8-Unauthenticated-Remote-Code-Execution.html"
},
{
"tags": [
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/156593/Cacti-1.2.8-Unauthenticated-Remote-Code-Execution.html"
},
{
"name": "FEDORA-2020-552e4e7879",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M77SS33IDVNGBU566TK2XVULPW3RXUQ4/"
},
{
"name": "FEDORA-2020-10fe60d68b",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XEMDQXDRNQYXOME7TACKDVCXZXZNGZE2/"
},
{
"name": "FEDORA-2020-d6a9e27bb1",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WAX3LDXPIKWNBGVZSIMZV7LI5K6BZRTO/"
},
{
"name": "openSUSE-SU-2020:0558",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00042.html"
},
{
"tags": [
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/157477/Open-AudIT-Professional-3.3.1-Remote-Code-Execution.html"
},
{
"name": "openSUSE-SU-2020:0565",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00048.html"
},
{
"name": "GLSA-202004-16",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/202004-16"
},
{
"name": "[debian-lts-announce] 20221231 [SECURITY] [DLA 3252-1] cacti security update",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2022/12/msg00039.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "graph_realtime.php in Cacti 1.2.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in a cookie, if a guest user has the graph real-time privilege."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-12-31T00:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://gist.github.com/mhaskar/ebe6b74c32fd0f7e1eedf1aabfd44129"
},
{
"url": "https://drive.google.com/file/d/1A8hxTyk_NgSp04zPX-23nPbsSDeyDFio/view"
},
{
"url": "https://github.com/Cacti/cacti/releases"
},
{
"url": "https://shells.systems/cacti-v1-2-8-authenticated-remote-code-execution-cve-2020-8813/"
},
{
"url": "https://github.com/Cacti/cacti/issues/3285"
},
{
"url": "http://packetstormsecurity.com/files/156538/Cacti-1.2.8-Authenticated-Remote-Code-Execution.html"
},
{
"url": "http://packetstormsecurity.com/files/156537/Cacti-1.2.8-Unauthenticated-Remote-Code-Execution.html"
},
{
"url": "http://packetstormsecurity.com/files/156593/Cacti-1.2.8-Unauthenticated-Remote-Code-Execution.html"
},
{
"name": "FEDORA-2020-552e4e7879",
"tags": [
"vendor-advisory"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M77SS33IDVNGBU566TK2XVULPW3RXUQ4/"
},
{
"name": "FEDORA-2020-10fe60d68b",
"tags": [
"vendor-advisory"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XEMDQXDRNQYXOME7TACKDVCXZXZNGZE2/"
},
{
"name": "FEDORA-2020-d6a9e27bb1",
"tags": [
"vendor-advisory"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WAX3LDXPIKWNBGVZSIMZV7LI5K6BZRTO/"
},
{
"name": "openSUSE-SU-2020:0558",
"tags": [
"vendor-advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00042.html"
},
{
"url": "http://packetstormsecurity.com/files/157477/Open-AudIT-Professional-3.3.1-Remote-Code-Execution.html"
},
{
"name": "openSUSE-SU-2020:0565",
"tags": [
"vendor-advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00048.html"
},
{
"name": "GLSA-202004-16",
"tags": [
"vendor-advisory"
],
"url": "https://security.gentoo.org/glsa/202004-16"
},
{
"name": "[debian-lts-announce] 20221231 [SECURITY] [DLA 3252-1] cacti security update",
"tags": [
"mailing-list"
],
"url": "https://lists.debian.org/debian-lts-announce/2022/12/msg00039.html"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2020-8813",
"datePublished": "2020-02-22T00:00:00",
"dateReserved": "2020-02-07T00:00:00",
"dateUpdated": "2024-08-04T10:12:10.614Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2020-8813\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2020-02-22T02:15:10.553\",\"lastModified\":\"2024-11-21T05:39:29.410\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"graph_realtime.php in Cacti 1.2.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in a cookie, if a guest user has the graph real-time privilege.\"},{\"lang\":\"es\",\"value\":\"El archivo graph_realtime.php en Cacti versi\u00f3n 1.2.8, permite a atacantes remotos ejecutar comandos arbitrarios de Sistema Operativo por medio de metacaracteres de shell en una cookie, si un usuario invitado posee el privilegio graph real-time.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:N/C:C/I:C/A:C\",\"baseScore\":9.3,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"COMPLETE\",\"integrityImpact\":\"COMPLETE\",\"availabilityImpact\":\"COMPLETE\"},\"baseSeverity\":\"HIGH\",\"exploitabilityScore\":8.6,\"impactScore\":10.0,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-78\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cacti:cacti:1.2.8:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2D05824B-4E66-44CA-A862-0DDDB23C8C88\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"97A4B8DF-58DA-4AB6-A1F9-331B36409BA3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"80F0FA5D-8D3B-4C0E-81E2-87998286AF33\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"36D96259-24BD-44E2-96D9-78CE1D41F956\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:opmantek:open-audit:3.3.1:*:*:*:-:*:*:*\",\"matchCriteriaId\":\"89AEB128-B4F3-447F-B458-D4A34A477979\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:opensuse:suse_package_hub:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"90EA34D4-1AF5-4D1E-AA95-63C605BE1386\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:opensuse:suse_linux_enterprise_server:12.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BC3D1104-C0AA-45DE-86A1-5D7CC8281B39\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"07B237A9-69A3-4A9C-9DA0-4E06BD37AE73\"}]}]}],\"references\":[{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00042.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00048.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"http://packetstormsecurity.com/files/156537/Cacti-1.2.8-Unauthenticated-Remote-Code-Execution.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://packetstormsecurity.com/files/156538/Cacti-1.2.8-Authenticated-Remote-Code-Execution.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://packetstormsecurity.com/files/156593/Cacti-1.2.8-Unauthenticated-Remote-Code-Execution.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://packetstormsecurity.com/files/157477/Open-AudIT-Professional-3.3.1-Remote-Code-Execution.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://drive.google.com/file/d/1A8hxTyk_NgSp04zPX-23nPbsSDeyDFio/view\",\"source\":\"cve@mitre.org\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"https://gist.github.com/mhaskar/ebe6b74c32fd0f7e1eedf1aabfd44129\",\"source\":\"cve@mitre.org\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/Cacti/cacti/issues/3285\",\"source\":\"cve@mitre.org\",\"tags\":[\"Issue Tracking\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/Cacti/cacti/releases\",\"source\":\"cve@mitre.org\",\"tags\":[\"Release Notes\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2022/12/msg00039.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M77SS33IDVNGBU566TK2XVULPW3RXUQ4/\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WAX3LDXPIKWNBGVZSIMZV7LI5K6BZRTO/\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XEMDQXDRNQYXOME7TACKDVCXZXZNGZE2/\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://security.gentoo.org/glsa/202004-16\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://shells.systems/cacti-v1-2-8-authenticated-remote-code-execution-cve-2020-8813/\",\"source\":\"cve@mitre.org\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00042.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00048.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"http://packetstormsecurity.com/files/156537/Cacti-1.2.8-Unauthenticated-Remote-Code-Execution.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://packetstormsecurity.com/files/156538/Cacti-1.2.8-Authenticated-Remote-Code-Execution.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://packetstormsecurity.com/files/156593/Cacti-1.2.8-Unauthenticated-Remote-Code-Execution.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://packetstormsecurity.com/files/157477/Open-AudIT-Professional-3.3.1-Remote-Code-Execution.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://drive.google.com/file/d/1A8hxTyk_NgSp04zPX-23nPbsSDeyDFio/view\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"https://gist.github.com/mhaskar/ebe6b74c32fd0f7e1eedf1aabfd44129\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/Cacti/cacti/issues/3285\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/Cacti/cacti/releases\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Release Notes\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2022/12/msg00039.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M77SS33IDVNGBU566TK2XVULPW3RXUQ4/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WAX3LDXPIKWNBGVZSIMZV7LI5K6BZRTO/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XEMDQXDRNQYXOME7TACKDVCXZXZNGZE2/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://security.gentoo.org/glsa/202004-16\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://shells.systems/cacti-v1-2-8-authenticated-remote-code-execution-cve-2020-8813/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]}]}}"
}
}
fkie_cve-2020-8813
Vulnerability from fkie_nvd
Published
2020-02-22 02:15
Modified
2024-11-21 05:39
Severity ?
Summary
graph_realtime.php in Cacti 1.2.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in a cookie, if a guest user has the graph real-time privilege.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cacti | cacti | 1.2.8 | |
| fedoraproject | fedora | 30 | |
| fedoraproject | fedora | 31 | |
| fedoraproject | fedora | 32 | |
| opmantek | open-audit | 3.3.1 | |
| opensuse | suse_package_hub | * | |
| opensuse | suse_linux_enterprise_server | 12.0 | |
| debian | debian_linux | 10.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cacti:cacti:1.2.8:*:*:*:*:*:*:*",
"matchCriteriaId": "2D05824B-4E66-44CA-A862-0DDDB23C8C88",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*",
"matchCriteriaId": "97A4B8DF-58DA-4AB6-A1F9-331B36409BA3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*",
"matchCriteriaId": "80F0FA5D-8D3B-4C0E-81E2-87998286AF33",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*",
"matchCriteriaId": "36D96259-24BD-44E2-96D9-78CE1D41F956",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:opmantek:open-audit:3.3.1:*:*:*:-:*:*:*",
"matchCriteriaId": "89AEB128-B4F3-447F-B458-D4A34A477979",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:opensuse:suse_package_hub:*:*:*:*:*:*:*:*",
"matchCriteriaId": "90EA34D4-1AF5-4D1E-AA95-63C605BE1386",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:opensuse:suse_linux_enterprise_server:12.0:*:*:*:*:*:*:*",
"matchCriteriaId": "BC3D1104-C0AA-45DE-86A1-5D7CC8281B39",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
"matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "graph_realtime.php in Cacti 1.2.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in a cookie, if a guest user has the graph real-time privilege."
},
{
"lang": "es",
"value": "El archivo graph_realtime.php en Cacti versi\u00f3n 1.2.8, permite a atacantes remotos ejecutar comandos arbitrarios de Sistema Operativo por medio de metacaracteres de shell en una cookie, si un usuario invitado posee el privilegio graph real-time."
}
],
"id": "CVE-2020-8813",
"lastModified": "2024-11-21T05:39:29.410",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 9.3,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 10.0,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2020-02-22T02:15:10.553",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00042.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00048.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://packetstormsecurity.com/files/156537/Cacti-1.2.8-Unauthenticated-Remote-Code-Execution.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://packetstormsecurity.com/files/156538/Cacti-1.2.8-Authenticated-Remote-Code-Execution.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://packetstormsecurity.com/files/156593/Cacti-1.2.8-Unauthenticated-Remote-Code-Execution.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://packetstormsecurity.com/files/157477/Open-AudIT-Professional-3.3.1-Remote-Code-Execution.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://drive.google.com/file/d/1A8hxTyk_NgSp04zPX-23nPbsSDeyDFio/view"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://gist.github.com/mhaskar/ebe6b74c32fd0f7e1eedf1aabfd44129"
},
{
"source": "cve@mitre.org",
"tags": [
"Issue Tracking",
"Third Party Advisory"
],
"url": "https://github.com/Cacti/cacti/issues/3285"
},
{
"source": "cve@mitre.org",
"tags": [
"Release Notes"
],
"url": "https://github.com/Cacti/cacti/releases"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.debian.org/debian-lts-announce/2022/12/msg00039.html"
},
{
"source": "cve@mitre.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M77SS33IDVNGBU566TK2XVULPW3RXUQ4/"
},
{
"source": "cve@mitre.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WAX3LDXPIKWNBGVZSIMZV7LI5K6BZRTO/"
},
{
"source": "cve@mitre.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XEMDQXDRNQYXOME7TACKDVCXZXZNGZE2/"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://security.gentoo.org/glsa/202004-16"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://shells.systems/cacti-v1-2-8-authenticated-remote-code-execution-cve-2020-8813/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00042.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00048.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://packetstormsecurity.com/files/156537/Cacti-1.2.8-Unauthenticated-Remote-Code-Execution.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://packetstormsecurity.com/files/156538/Cacti-1.2.8-Authenticated-Remote-Code-Execution.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://packetstormsecurity.com/files/156593/Cacti-1.2.8-Unauthenticated-Remote-Code-Execution.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://packetstormsecurity.com/files/157477/Open-AudIT-Professional-3.3.1-Remote-Code-Execution.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://drive.google.com/file/d/1A8hxTyk_NgSp04zPX-23nPbsSDeyDFio/view"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://gist.github.com/mhaskar/ebe6b74c32fd0f7e1eedf1aabfd44129"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking",
"Third Party Advisory"
],
"url": "https://github.com/Cacti/cacti/issues/3285"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes"
],
"url": "https://github.com/Cacti/cacti/releases"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.debian.org/debian-lts-announce/2022/12/msg00039.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M77SS33IDVNGBU566TK2XVULPW3RXUQ4/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WAX3LDXPIKWNBGVZSIMZV7LI5K6BZRTO/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XEMDQXDRNQYXOME7TACKDVCXZXZNGZE2/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://security.gentoo.org/glsa/202004-16"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://shells.systems/cacti-v1-2-8-authenticated-remote-code-execution-cve-2020-8813/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-78"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
opensuse-su-2020:0565-1
Vulnerability from csaf_opensuse
Published
2020-04-30 15:35
Modified
2020-04-30 15:35
Summary
Security update for cacti, cacti-spine
Notes
Title of the patch
Security update for cacti, cacti-spine
Description of the patch
This update for cacti, cacti-spine to version 1.2.11 fixes the following issues:
This update is fixing multiple vulnerabilities and adding bug fixes. For more details consult the changes file.
This update was imported from the openSUSE:Leap:15.1:Update update project.
Patchnames
openSUSE-2020-565
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for cacti, cacti-spine",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for cacti, cacti-spine to version 1.2.11 fixes the following issues:\n\nThis update is fixing multiple vulnerabilities and adding bug fixes. For more details consult the changes file.\n\nThis update was imported from the openSUSE:Leap:15.1:Update update project.",
"title": "Description of the patch"
},
{
"category": "details",
"text": "openSUSE-2020-565",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2020_0565-1.json"
},
{
"category": "self",
"summary": "URL for openSUSE-SU-2020:0565-1",
"url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/ZCYZNXPQBT3RNEEVMDXCIG76SLTOPTF5/"
},
{
"category": "self",
"summary": "E-Mail link for openSUSE-SU-2020:0565-1",
"url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/ZCYZNXPQBT3RNEEVMDXCIG76SLTOPTF5/"
},
{
"category": "self",
"summary": "SUSE Bug 1082318",
"url": "https://bugzilla.suse.com/1082318"
},
{
"category": "self",
"summary": "SUSE Bug 1122242",
"url": "https://bugzilla.suse.com/1122242"
},
{
"category": "self",
"summary": "SUSE Bug 1122243",
"url": "https://bugzilla.suse.com/1122243"
},
{
"category": "self",
"summary": "SUSE Bug 1122244",
"url": "https://bugzilla.suse.com/1122244"
},
{
"category": "self",
"summary": "SUSE Bug 1122245",
"url": "https://bugzilla.suse.com/1122245"
},
{
"category": "self",
"summary": "SUSE Bug 1122535",
"url": "https://bugzilla.suse.com/1122535"
},
{
"category": "self",
"summary": "SUSE Bug 1158990",
"url": "https://bugzilla.suse.com/1158990"
},
{
"category": "self",
"summary": "SUSE Bug 1158992",
"url": "https://bugzilla.suse.com/1158992"
},
{
"category": "self",
"summary": "SUSE Bug 1161297",
"url": "https://bugzilla.suse.com/1161297"
},
{
"category": "self",
"summary": "SUSE Bug 1164675",
"url": "https://bugzilla.suse.com/1164675"
},
{
"category": "self",
"summary": "SUSE Bug 1169215",
"url": "https://bugzilla.suse.com/1169215"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2009-4112 page",
"url": "https://www.suse.com/security/cve/CVE-2009-4112/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-20723 page",
"url": "https://www.suse.com/security/cve/CVE-2018-20723/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-20724 page",
"url": "https://www.suse.com/security/cve/CVE-2018-20724/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-20725 page",
"url": "https://www.suse.com/security/cve/CVE-2018-20725/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-20726 page",
"url": "https://www.suse.com/security/cve/CVE-2018-20726/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2019-16723 page",
"url": "https://www.suse.com/security/cve/CVE-2019-16723/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2019-17357 page",
"url": "https://www.suse.com/security/cve/CVE-2019-17357/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2019-17358 page",
"url": "https://www.suse.com/security/cve/CVE-2019-17358/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-7106 page",
"url": "https://www.suse.com/security/cve/CVE-2020-7106/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-7237 page",
"url": "https://www.suse.com/security/cve/CVE-2020-7237/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-8813 page",
"url": "https://www.suse.com/security/cve/CVE-2020-8813/"
}
],
"title": "Security update for cacti, cacti-spine",
"tracking": {
"current_release_date": "2020-04-30T15:35:25Z",
"generator": {
"date": "2020-04-30T15:35:25Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "openSUSE-SU-2020:0565-1",
"initial_release_date": "2020-04-30T15:35:25Z",
"revision_history": [
{
"date": "2020-04-30T15:35:25Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "cacti-spine-1.2.11-bp151.4.6.1.aarch64",
"product": {
"name": "cacti-spine-1.2.11-bp151.4.6.1.aarch64",
"product_id": "cacti-spine-1.2.11-bp151.4.6.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "cacti-1.2.11-bp151.4.6.1.noarch",
"product": {
"name": "cacti-1.2.11-bp151.4.6.1.noarch",
"product_id": "cacti-1.2.11-bp151.4.6.1.noarch"
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "cacti-spine-1.2.11-bp151.4.6.1.ppc64le",
"product": {
"name": "cacti-spine-1.2.11-bp151.4.6.1.ppc64le",
"product_id": "cacti-spine-1.2.11-bp151.4.6.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "cacti-spine-1.2.11-bp151.4.6.1.s390x",
"product": {
"name": "cacti-spine-1.2.11-bp151.4.6.1.s390x",
"product_id": "cacti-spine-1.2.11-bp151.4.6.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "cacti-spine-1.2.11-bp151.4.6.1.x86_64",
"product": {
"name": "cacti-spine-1.2.11-bp151.4.6.1.x86_64",
"product_id": "cacti-spine-1.2.11-bp151.4.6.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Package Hub 15 SP1",
"product": {
"name": "SUSE Package Hub 15 SP1",
"product_id": "SUSE Package Hub 15 SP1"
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "cacti-1.2.11-bp151.4.6.1.noarch as component of SUSE Package Hub 15 SP1",
"product_id": "SUSE Package Hub 15 SP1:cacti-1.2.11-bp151.4.6.1.noarch"
},
"product_reference": "cacti-1.2.11-bp151.4.6.1.noarch",
"relates_to_product_reference": "SUSE Package Hub 15 SP1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cacti-spine-1.2.11-bp151.4.6.1.aarch64 as component of SUSE Package Hub 15 SP1",
"product_id": "SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.aarch64"
},
"product_reference": "cacti-spine-1.2.11-bp151.4.6.1.aarch64",
"relates_to_product_reference": "SUSE Package Hub 15 SP1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cacti-spine-1.2.11-bp151.4.6.1.ppc64le as component of SUSE Package Hub 15 SP1",
"product_id": "SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.ppc64le"
},
"product_reference": "cacti-spine-1.2.11-bp151.4.6.1.ppc64le",
"relates_to_product_reference": "SUSE Package Hub 15 SP1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cacti-spine-1.2.11-bp151.4.6.1.s390x as component of SUSE Package Hub 15 SP1",
"product_id": "SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.s390x"
},
"product_reference": "cacti-spine-1.2.11-bp151.4.6.1.s390x",
"relates_to_product_reference": "SUSE Package Hub 15 SP1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cacti-spine-1.2.11-bp151.4.6.1.x86_64 as component of SUSE Package Hub 15 SP1",
"product_id": "SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.x86_64"
},
"product_reference": "cacti-spine-1.2.11-bp151.4.6.1.x86_64",
"relates_to_product_reference": "SUSE Package Hub 15 SP1"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2009-4112",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2009-4112"
}
],
"notes": [
{
"category": "general",
"text": "Cacti 0.8.7e and earlier allows remote authenticated administrators to gain privileges by modifying the \"Data Input Method\" for the \"Linux - Get Memory Usage\" setting to contain arbitrary commands.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Package Hub 15 SP1:cacti-1.2.11-bp151.4.6.1.noarch",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.aarch64",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.ppc64le",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.s390x",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2009-4112",
"url": "https://www.suse.com/security/cve/CVE-2009-4112"
},
{
"category": "external",
"summary": "SUSE Bug 1122535 for CVE-2009-4112",
"url": "https://bugzilla.suse.com/1122535"
},
{
"category": "external",
"summary": "SUSE Bug 558664 for CVE-2009-4112",
"url": "https://bugzilla.suse.com/558664"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Package Hub 15 SP1:cacti-1.2.11-bp151.4.6.1.noarch",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.aarch64",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.ppc64le",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.s390x",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-04-30T15:35:25Z",
"details": "important"
}
],
"title": "CVE-2009-4112"
},
{
"cve": "CVE-2018-20723",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-20723"
}
],
"notes": [
{
"category": "general",
"text": "A cross-site scripting (XSS) vulnerability exists in color_templates.php in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Name field for a Color.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Package Hub 15 SP1:cacti-1.2.11-bp151.4.6.1.noarch",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.aarch64",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.ppc64le",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.s390x",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-20723",
"url": "https://www.suse.com/security/cve/CVE-2018-20723"
},
{
"category": "external",
"summary": "SUSE Bug 1122245 for CVE-2018-20723",
"url": "https://bugzilla.suse.com/1122245"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Package Hub 15 SP1:cacti-1.2.11-bp151.4.6.1.noarch",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.aarch64",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.ppc64le",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.s390x",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"SUSE Package Hub 15 SP1:cacti-1.2.11-bp151.4.6.1.noarch",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.aarch64",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.ppc64le",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.s390x",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-04-30T15:35:25Z",
"details": "moderate"
}
],
"title": "CVE-2018-20723"
},
{
"cve": "CVE-2018-20724",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-20724"
}
],
"notes": [
{
"category": "general",
"text": "A cross-site scripting (XSS) vulnerability exists in pollers.php in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Website Hostname for Data Collectors.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Package Hub 15 SP1:cacti-1.2.11-bp151.4.6.1.noarch",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.aarch64",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.ppc64le",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.s390x",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-20724",
"url": "https://www.suse.com/security/cve/CVE-2018-20724"
},
{
"category": "external",
"summary": "SUSE Bug 1122244 for CVE-2018-20724",
"url": "https://bugzilla.suse.com/1122244"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Package Hub 15 SP1:cacti-1.2.11-bp151.4.6.1.noarch",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.aarch64",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.ppc64le",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.s390x",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"SUSE Package Hub 15 SP1:cacti-1.2.11-bp151.4.6.1.noarch",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.aarch64",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.ppc64le",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.s390x",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-04-30T15:35:25Z",
"details": "moderate"
}
],
"title": "CVE-2018-20724"
},
{
"cve": "CVE-2018-20725",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-20725"
}
],
"notes": [
{
"category": "general",
"text": "A cross-site scripting (XSS) vulnerability exists in graph_templates.php in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Graph Vertical Label.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Package Hub 15 SP1:cacti-1.2.11-bp151.4.6.1.noarch",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.aarch64",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.ppc64le",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.s390x",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-20725",
"url": "https://www.suse.com/security/cve/CVE-2018-20725"
},
{
"category": "external",
"summary": "SUSE Bug 1122243 for CVE-2018-20725",
"url": "https://bugzilla.suse.com/1122243"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Package Hub 15 SP1:cacti-1.2.11-bp151.4.6.1.noarch",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.aarch64",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.ppc64le",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.s390x",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"SUSE Package Hub 15 SP1:cacti-1.2.11-bp151.4.6.1.noarch",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.aarch64",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.ppc64le",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.s390x",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-04-30T15:35:25Z",
"details": "moderate"
}
],
"title": "CVE-2018-20725"
},
{
"cve": "CVE-2018-20726",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-20726"
}
],
"notes": [
{
"category": "general",
"text": "A cross-site scripting (XSS) vulnerability exists in host.php (via tree.php) in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Website Hostname field for Devices.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Package Hub 15 SP1:cacti-1.2.11-bp151.4.6.1.noarch",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.aarch64",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.ppc64le",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.s390x",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-20726",
"url": "https://www.suse.com/security/cve/CVE-2018-20726"
},
{
"category": "external",
"summary": "SUSE Bug 1122242 for CVE-2018-20726",
"url": "https://bugzilla.suse.com/1122242"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Package Hub 15 SP1:cacti-1.2.11-bp151.4.6.1.noarch",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.aarch64",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.ppc64le",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.s390x",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"SUSE Package Hub 15 SP1:cacti-1.2.11-bp151.4.6.1.noarch",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.aarch64",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.ppc64le",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.s390x",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-04-30T15:35:25Z",
"details": "moderate"
}
],
"title": "CVE-2018-20726"
},
{
"cve": "CVE-2019-16723",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2019-16723"
}
],
"notes": [
{
"category": "general",
"text": "In Cacti through 1.2.6, authenticated users may bypass authorization checks (for viewing a graph) via a direct graph_json.php request with a modified local_graph_id parameter.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Package Hub 15 SP1:cacti-1.2.11-bp151.4.6.1.noarch",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.aarch64",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.ppc64le",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.s390x",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2019-16723",
"url": "https://www.suse.com/security/cve/CVE-2019-16723"
},
{
"category": "external",
"summary": "SUSE Bug 1151788 for CVE-2019-16723",
"url": "https://bugzilla.suse.com/1151788"
},
{
"category": "external",
"summary": "SUSE Bug 1214170 for CVE-2019-16723",
"url": "https://bugzilla.suse.com/1214170"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Package Hub 15 SP1:cacti-1.2.11-bp151.4.6.1.noarch",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.aarch64",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.ppc64le",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.s390x",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"SUSE Package Hub 15 SP1:cacti-1.2.11-bp151.4.6.1.noarch",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.aarch64",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.ppc64le",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.s390x",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-04-30T15:35:25Z",
"details": "moderate"
}
],
"title": "CVE-2019-16723"
},
{
"cve": "CVE-2019-17357",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2019-17357"
}
],
"notes": [
{
"category": "general",
"text": "Cacti through 1.2.7 is affected by a graphs.php?template_id= SQL injection vulnerability affecting how template identifiers are handled when a string and id composite value are used to identify the template type and id. An authenticated attacker can exploit this to extract data from the database, or an unauthenticated remote attacker could exploit this via Cross-Site Request Forgery.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Package Hub 15 SP1:cacti-1.2.11-bp151.4.6.1.noarch",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.aarch64",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.ppc64le",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.s390x",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2019-17357",
"url": "https://www.suse.com/security/cve/CVE-2019-17357"
},
{
"category": "external",
"summary": "SUSE Bug 1158990 for CVE-2019-17357",
"url": "https://bugzilla.suse.com/1158990"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Package Hub 15 SP1:cacti-1.2.11-bp151.4.6.1.noarch",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.aarch64",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.ppc64le",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.s390x",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"SUSE Package Hub 15 SP1:cacti-1.2.11-bp151.4.6.1.noarch",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.aarch64",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.ppc64le",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.s390x",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-04-30T15:35:25Z",
"details": "important"
}
],
"title": "CVE-2019-17357"
},
{
"cve": "CVE-2019-17358",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2019-17358"
}
],
"notes": [
{
"category": "general",
"text": "Cacti through 1.2.7 is affected by multiple instances of lib/functions.php unsafe deserialization of user-controlled data to populate arrays. An authenticated attacker could use this to influence object data values and control actions taken by Cacti or potentially cause memory corruption in the PHP module.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Package Hub 15 SP1:cacti-1.2.11-bp151.4.6.1.noarch",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.aarch64",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.ppc64le",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.s390x",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2019-17358",
"url": "https://www.suse.com/security/cve/CVE-2019-17358"
},
{
"category": "external",
"summary": "SUSE Bug 1158992 for CVE-2019-17358",
"url": "https://bugzilla.suse.com/1158992"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Package Hub 15 SP1:cacti-1.2.11-bp151.4.6.1.noarch",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.aarch64",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.ppc64le",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.s390x",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Package Hub 15 SP1:cacti-1.2.11-bp151.4.6.1.noarch",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.aarch64",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.ppc64le",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.s390x",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-04-30T15:35:25Z",
"details": "moderate"
}
],
"title": "CVE-2019-17358"
},
{
"cve": "CVE-2020-7106",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-7106"
}
],
"notes": [
{
"category": "general",
"text": "Cacti 1.2.8 has stored XSS in data_sources.php, color_templates_item.php, graphs.php, graph_items.php, lib/api_automation.php, user_admin.php, and user_group_admin.php, as demonstrated by the description parameter in data_sources.php (a raw string from the database that is displayed by $header to trigger the XSS).",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Package Hub 15 SP1:cacti-1.2.11-bp151.4.6.1.noarch",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.aarch64",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.ppc64le",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.s390x",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-7106",
"url": "https://www.suse.com/security/cve/CVE-2020-7106"
},
{
"category": "external",
"summary": "SUSE Bug 1163749 for CVE-2020-7106",
"url": "https://bugzilla.suse.com/1163749"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Package Hub 15 SP1:cacti-1.2.11-bp151.4.6.1.noarch",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.aarch64",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.ppc64le",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.s390x",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Package Hub 15 SP1:cacti-1.2.11-bp151.4.6.1.noarch",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.aarch64",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.ppc64le",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.s390x",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-04-30T15:35:25Z",
"details": "moderate"
}
],
"title": "CVE-2020-7106"
},
{
"cve": "CVE-2020-7237",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-7237"
}
],
"notes": [
{
"category": "general",
"text": "Cacti 1.2.8 allows Remote Code Execution (by privileged users) via shell metacharacters in the Performance Boost Debug Log field of poller_automation.php. OS commands are executed when a new poller cycle begins. The attacker must be authenticated, and must have access to modify the Performance Settings of the product.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Package Hub 15 SP1:cacti-1.2.11-bp151.4.6.1.noarch",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.aarch64",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.ppc64le",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.s390x",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-7237",
"url": "https://www.suse.com/security/cve/CVE-2020-7237"
},
{
"category": "external",
"summary": "SUSE Bug 1161297 for CVE-2020-7237",
"url": "https://bugzilla.suse.com/1161297"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Package Hub 15 SP1:cacti-1.2.11-bp151.4.6.1.noarch",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.aarch64",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.ppc64le",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.s390x",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Package Hub 15 SP1:cacti-1.2.11-bp151.4.6.1.noarch",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.aarch64",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.ppc64le",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.s390x",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-04-30T15:35:25Z",
"details": "important"
}
],
"title": "CVE-2020-7237"
},
{
"cve": "CVE-2020-8813",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-8813"
}
],
"notes": [
{
"category": "general",
"text": "graph_realtime.php in Cacti 1.2.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in a cookie, if a guest user has the graph real-time privilege.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Package Hub 15 SP1:cacti-1.2.11-bp151.4.6.1.noarch",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.aarch64",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.ppc64le",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.s390x",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-8813",
"url": "https://www.suse.com/security/cve/CVE-2020-8813"
},
{
"category": "external",
"summary": "SUSE Bug 1154087 for CVE-2020-8813",
"url": "https://bugzilla.suse.com/1154087"
},
{
"category": "external",
"summary": "SUSE Bug 1160867 for CVE-2020-8813",
"url": "https://bugzilla.suse.com/1160867"
},
{
"category": "external",
"summary": "SUSE Bug 1164675 for CVE-2020-8813",
"url": "https://bugzilla.suse.com/1164675"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Package Hub 15 SP1:cacti-1.2.11-bp151.4.6.1.noarch",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.aarch64",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.ppc64le",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.s390x",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Package Hub 15 SP1:cacti-1.2.11-bp151.4.6.1.noarch",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.aarch64",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.ppc64le",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.s390x",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.11-bp151.4.6.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-04-30T15:35:25Z",
"details": "critical"
}
],
"title": "CVE-2020-8813"
}
]
}
opensuse-su-2024:10670-1
Vulnerability from csaf_opensuse
Published
2024-06-15 00:00
Modified
2024-06-15 00:00
Summary
cacti-1.2.18-1.2 on GA media
Notes
Title of the patch
cacti-1.2.18-1.2 on GA media
Description of the patch
These are all security issues fixed in the cacti-1.2.18-1.2 package on the GA media of openSUSE Tumbleweed.
Patchnames
openSUSE-Tumbleweed-2024-10670
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "cacti-1.2.18-1.2 on GA media",
"title": "Title of the patch"
},
{
"category": "description",
"text": "These are all security issues fixed in the cacti-1.2.18-1.2 package on the GA media of openSUSE Tumbleweed.",
"title": "Description of the patch"
},
{
"category": "details",
"text": "openSUSE-Tumbleweed-2024-10670",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2024_10670-1.json"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2006-6799 page",
"url": "https://www.suse.com/security/cve/CVE-2006-6799/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2007-3112 page",
"url": "https://www.suse.com/security/cve/CVE-2007-3112/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2009-4112 page",
"url": "https://www.suse.com/security/cve/CVE-2009-4112/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2014-4000 page",
"url": "https://www.suse.com/security/cve/CVE-2014-4000/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-10970 page",
"url": "https://www.suse.com/security/cve/CVE-2017-10970/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-11163 page",
"url": "https://www.suse.com/security/cve/CVE-2017-11163/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-11691 page",
"url": "https://www.suse.com/security/cve/CVE-2017-11691/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-12065 page",
"url": "https://www.suse.com/security/cve/CVE-2017-12065/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-12927 page",
"url": "https://www.suse.com/security/cve/CVE-2017-12927/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-12978 page",
"url": "https://www.suse.com/security/cve/CVE-2017-12978/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-15194 page",
"url": "https://www.suse.com/security/cve/CVE-2017-15194/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-16641 page",
"url": "https://www.suse.com/security/cve/CVE-2017-16641/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-16660 page",
"url": "https://www.suse.com/security/cve/CVE-2017-16660/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-16661 page",
"url": "https://www.suse.com/security/cve/CVE-2017-16661/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-16785 page",
"url": "https://www.suse.com/security/cve/CVE-2017-16785/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-20723 page",
"url": "https://www.suse.com/security/cve/CVE-2018-20723/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-20724 page",
"url": "https://www.suse.com/security/cve/CVE-2018-20724/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-20725 page",
"url": "https://www.suse.com/security/cve/CVE-2018-20725/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-20726 page",
"url": "https://www.suse.com/security/cve/CVE-2018-20726/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2019-16723 page",
"url": "https://www.suse.com/security/cve/CVE-2019-16723/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2019-17357 page",
"url": "https://www.suse.com/security/cve/CVE-2019-17357/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2019-17358 page",
"url": "https://www.suse.com/security/cve/CVE-2019-17358/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-11022 page",
"url": "https://www.suse.com/security/cve/CVE-2020-11022/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-13625 page",
"url": "https://www.suse.com/security/cve/CVE-2020-13625/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-14295 page",
"url": "https://www.suse.com/security/cve/CVE-2020-14295/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-14424 page",
"url": "https://www.suse.com/security/cve/CVE-2020-14424/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-25706 page",
"url": "https://www.suse.com/security/cve/CVE-2020-25706/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-35701 page",
"url": "https://www.suse.com/security/cve/CVE-2020-35701/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-7106 page",
"url": "https://www.suse.com/security/cve/CVE-2020-7106/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-7237 page",
"url": "https://www.suse.com/security/cve/CVE-2020-7237/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-8813 page",
"url": "https://www.suse.com/security/cve/CVE-2020-8813/"
}
],
"title": "cacti-1.2.18-1.2 on GA media",
"tracking": {
"current_release_date": "2024-06-15T00:00:00Z",
"generator": {
"date": "2024-06-15T00:00:00Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "openSUSE-SU-2024:10670-1",
"initial_release_date": "2024-06-15T00:00:00Z",
"revision_history": [
{
"date": "2024-06-15T00:00:00Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "cacti-1.2.18-1.2.aarch64",
"product": {
"name": "cacti-1.2.18-1.2.aarch64",
"product_id": "cacti-1.2.18-1.2.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "cacti-1.2.18-1.2.ppc64le",
"product": {
"name": "cacti-1.2.18-1.2.ppc64le",
"product_id": "cacti-1.2.18-1.2.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "cacti-1.2.18-1.2.s390x",
"product": {
"name": "cacti-1.2.18-1.2.s390x",
"product_id": "cacti-1.2.18-1.2.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "cacti-1.2.18-1.2.x86_64",
"product": {
"name": "cacti-1.2.18-1.2.x86_64",
"product_id": "cacti-1.2.18-1.2.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "openSUSE Tumbleweed",
"product": {
"name": "openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed",
"product_identification_helper": {
"cpe": "cpe:/o:opensuse:tumbleweed"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "cacti-1.2.18-1.2.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64"
},
"product_reference": "cacti-1.2.18-1.2.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cacti-1.2.18-1.2.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le"
},
"product_reference": "cacti-1.2.18-1.2.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cacti-1.2.18-1.2.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x"
},
"product_reference": "cacti-1.2.18-1.2.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cacti-1.2.18-1.2.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
},
"product_reference": "cacti-1.2.18-1.2.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2006-6799",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2006-6799"
}
],
"notes": [
{
"category": "general",
"text": "SQL injection vulnerability in Cacti 0.8.6i and earlier, when register_argc_argv is enabled, allows remote attackers to execute arbitrary SQL commands via the (1) second or (2) third arguments to cmd.php. NOTE: this issue can be leveraged to execute arbitrary commands since the SQL query results are later used in the polling_items array and popen function.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2006-6799",
"url": "https://www.suse.com/security/cve/CVE-2006-6799"
},
{
"category": "external",
"summary": "SUSE Bug 231082 for CVE-2006-6799",
"url": "https://bugzilla.suse.com/231082"
},
{
"category": "external",
"summary": "SUSE Bug 236724 for CVE-2006-6799",
"url": "https://bugzilla.suse.com/236724"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2006-6799"
},
{
"cve": "CVE-2007-3112",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2007-3112"
}
],
"notes": [
{
"category": "general",
"text": "graph_image.php in Cacti 0.8.6i, and possibly other versions, allows remote authenticated users to cause a denial of service (CPU consumption) via a large value of the (1) graph_start or (2) graph_end parameter, different vectors than CVE-2007-3113.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2007-3112",
"url": "https://www.suse.com/security/cve/CVE-2007-3112"
},
{
"category": "external",
"summary": "SUSE Bug 326228 for CVE-2007-3112",
"url": "https://bugzilla.suse.com/326228"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2007-3112"
},
{
"cve": "CVE-2009-4112",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2009-4112"
}
],
"notes": [
{
"category": "general",
"text": "Cacti 0.8.7e and earlier allows remote authenticated administrators to gain privileges by modifying the \"Data Input Method\" for the \"Linux - Get Memory Usage\" setting to contain arbitrary commands.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2009-4112",
"url": "https://www.suse.com/security/cve/CVE-2009-4112"
},
{
"category": "external",
"summary": "SUSE Bug 1122535 for CVE-2009-4112",
"url": "https://bugzilla.suse.com/1122535"
},
{
"category": "external",
"summary": "SUSE Bug 558664 for CVE-2009-4112",
"url": "https://bugzilla.suse.com/558664"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2009-4112"
},
{
"cve": "CVE-2014-4000",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2014-4000"
}
],
"notes": [
{
"category": "general",
"text": "Cacti before 1.0.0 allows remote authenticated users to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted serialized object, related to calling unserialize(stripslashes()).",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2014-4000",
"url": "https://www.suse.com/security/cve/CVE-2014-4000"
},
{
"category": "external",
"summary": "SUSE Bug 1022564 for CVE-2014-4000",
"url": "https://bugzilla.suse.com/1022564"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2014-4000"
},
{
"cve": "CVE-2017-10970",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-10970"
}
],
"notes": [
{
"category": "general",
"text": "Cross-site scripting (XSS) vulnerability in link.php in Cacti 1.1.12 allows remote anonymous users to inject arbitrary web script or HTML via the id parameter, related to the die_html_input_error function in lib/html_validate.php.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-10970",
"url": "https://www.suse.com/security/cve/CVE-2017-10970"
},
{
"category": "external",
"summary": "SUSE Bug 1047512 for CVE-2017-10970",
"url": "https://bugzilla.suse.com/1047512"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2017-10970"
},
{
"cve": "CVE-2017-11163",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-11163"
}
],
"notes": [
{
"category": "general",
"text": "Cross-site scripting (XSS) vulnerability in aggregate_graphs.php in Cacti 1.1.12 allows remote authenticated users to inject arbitrary web script or HTML via specially crafted HTTP Referer headers, related to the $cancel_url variable.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-11163",
"url": "https://www.suse.com/security/cve/CVE-2017-11163"
},
{
"category": "external",
"summary": "SUSE Bug 1048102 for CVE-2017-11163",
"url": "https://bugzilla.suse.com/1048102"
},
{
"category": "external",
"summary": "SUSE Bug 1051633 for CVE-2017-11163",
"url": "https://bugzilla.suse.com/1051633"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2017-11163"
},
{
"cve": "CVE-2017-11691",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-11691"
}
],
"notes": [
{
"category": "general",
"text": "Cross-site scripting (XSS) vulnerability in auth_profile.php in Cacti 1.1.13 allows remote attackers to inject arbitrary web script or HTML via specially crafted HTTP Referer headers.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-11691",
"url": "https://www.suse.com/security/cve/CVE-2017-11691"
},
{
"category": "external",
"summary": "SUSE Bug 1050950 for CVE-2017-11691",
"url": "https://bugzilla.suse.com/1050950"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2017-11691"
},
{
"cve": "CVE-2017-12065",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-12065"
}
],
"notes": [
{
"category": "general",
"text": "spikekill.php in Cacti before 1.1.16 might allow remote attackers to execute arbitrary code via the avgnan, outlier-start, or outlier-end parameter.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-12065",
"url": "https://www.suse.com/security/cve/CVE-2017-12065"
},
{
"category": "external",
"summary": "SUSE Bug 1051633 for CVE-2017-12065",
"url": "https://bugzilla.suse.com/1051633"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "critical"
}
],
"title": "CVE-2017-12065"
},
{
"cve": "CVE-2017-12927",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-12927"
}
],
"notes": [
{
"category": "general",
"text": "A cross-site scripting vulnerability exists in Cacti 1.1.17 in the method parameter in spikekill.php.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-12927",
"url": "https://www.suse.com/security/cve/CVE-2017-12927"
},
{
"category": "external",
"summary": "SUSE Bug 1054390 for CVE-2017-12927",
"url": "https://bugzilla.suse.com/1054390"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "critical"
}
],
"title": "CVE-2017-12927"
},
{
"cve": "CVE-2017-12978",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-12978"
}
],
"notes": [
{
"category": "general",
"text": "lib/html.php in Cacti before 1.1.18 has XSS via the title field of an external link added by an authenticated user.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-12978",
"url": "https://www.suse.com/security/cve/CVE-2017-12978"
},
{
"category": "external",
"summary": "SUSE Bug 1054742 for CVE-2017-12978",
"url": "https://bugzilla.suse.com/1054742"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2017-12978"
},
{
"cve": "CVE-2017-15194",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-15194"
}
],
"notes": [
{
"category": "general",
"text": "include/global_session.php in Cacti 1.1.25 has XSS related to (1) the URI or (2) the refresh page.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-15194",
"url": "https://www.suse.com/security/cve/CVE-2017-15194"
},
{
"category": "external",
"summary": "SUSE Bug 1062554 for CVE-2017-15194",
"url": "https://bugzilla.suse.com/1062554"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2017-15194"
},
{
"cve": "CVE-2017-16641",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-16641"
}
],
"notes": [
{
"category": "general",
"text": "lib/rrd.php in Cacti 1.1.27 allows remote authenticated administrators to execute arbitrary OS commands via the path_rrdtool parameter in an action=save request to settings.php.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-16641",
"url": "https://www.suse.com/security/cve/CVE-2017-16641"
},
{
"category": "external",
"summary": "SUSE Bug 1067166 for CVE-2017-16641",
"url": "https://bugzilla.suse.com/1067166"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "critical"
}
],
"title": "CVE-2017-16641"
},
{
"cve": "CVE-2017-16660",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-16660"
}
],
"notes": [
{
"category": "general",
"text": "Cacti 1.1.27 allows remote authenticated administrators to conduct Remote Code Execution attacks by placing the Log Path under the web root, and then making a remote_agent.php request containing PHP code in a Client-ip header.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-16660",
"url": "https://www.suse.com/security/cve/CVE-2017-16660"
},
{
"category": "external",
"summary": "SUSE Bug 1067164 for CVE-2017-16660",
"url": "https://bugzilla.suse.com/1067164"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "critical"
}
],
"title": "CVE-2017-16660"
},
{
"cve": "CVE-2017-16661",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-16661"
}
],
"notes": [
{
"category": "general",
"text": "Cacti 1.1.27 allows remote authenticated administrators to read arbitrary files by placing the Log Path into a private directory, and then making a clog.php?filename= request, as demonstrated by filename=passwd (with a Log Path under /etc) to read /etc/passwd.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-16661",
"url": "https://www.suse.com/security/cve/CVE-2017-16661"
},
{
"category": "external",
"summary": "SUSE Bug 1067163 for CVE-2017-16661",
"url": "https://bugzilla.suse.com/1067163"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2017-16661"
},
{
"cve": "CVE-2017-16785",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-16785"
}
],
"notes": [
{
"category": "general",
"text": "Cacti 1.1.27 has reflected XSS via the PATH_INFO to host.php.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-16785",
"url": "https://www.suse.com/security/cve/CVE-2017-16785"
},
{
"category": "external",
"summary": "SUSE Bug 1068028 for CVE-2017-16785",
"url": "https://bugzilla.suse.com/1068028"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2017-16785"
},
{
"cve": "CVE-2018-20723",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-20723"
}
],
"notes": [
{
"category": "general",
"text": "A cross-site scripting (XSS) vulnerability exists in color_templates.php in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Name field for a Color.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-20723",
"url": "https://www.suse.com/security/cve/CVE-2018-20723"
},
{
"category": "external",
"summary": "SUSE Bug 1122245 for CVE-2018-20723",
"url": "https://bugzilla.suse.com/1122245"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2018-20723"
},
{
"cve": "CVE-2018-20724",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-20724"
}
],
"notes": [
{
"category": "general",
"text": "A cross-site scripting (XSS) vulnerability exists in pollers.php in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Website Hostname for Data Collectors.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-20724",
"url": "https://www.suse.com/security/cve/CVE-2018-20724"
},
{
"category": "external",
"summary": "SUSE Bug 1122244 for CVE-2018-20724",
"url": "https://bugzilla.suse.com/1122244"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2018-20724"
},
{
"cve": "CVE-2018-20725",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-20725"
}
],
"notes": [
{
"category": "general",
"text": "A cross-site scripting (XSS) vulnerability exists in graph_templates.php in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Graph Vertical Label.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-20725",
"url": "https://www.suse.com/security/cve/CVE-2018-20725"
},
{
"category": "external",
"summary": "SUSE Bug 1122243 for CVE-2018-20725",
"url": "https://bugzilla.suse.com/1122243"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2018-20725"
},
{
"cve": "CVE-2018-20726",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-20726"
}
],
"notes": [
{
"category": "general",
"text": "A cross-site scripting (XSS) vulnerability exists in host.php (via tree.php) in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Website Hostname field for Devices.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-20726",
"url": "https://www.suse.com/security/cve/CVE-2018-20726"
},
{
"category": "external",
"summary": "SUSE Bug 1122242 for CVE-2018-20726",
"url": "https://bugzilla.suse.com/1122242"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2018-20726"
},
{
"cve": "CVE-2019-16723",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2019-16723"
}
],
"notes": [
{
"category": "general",
"text": "In Cacti through 1.2.6, authenticated users may bypass authorization checks (for viewing a graph) via a direct graph_json.php request with a modified local_graph_id parameter.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2019-16723",
"url": "https://www.suse.com/security/cve/CVE-2019-16723"
},
{
"category": "external",
"summary": "SUSE Bug 1151788 for CVE-2019-16723",
"url": "https://bugzilla.suse.com/1151788"
},
{
"category": "external",
"summary": "SUSE Bug 1214170 for CVE-2019-16723",
"url": "https://bugzilla.suse.com/1214170"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2019-16723"
},
{
"cve": "CVE-2019-17357",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2019-17357"
}
],
"notes": [
{
"category": "general",
"text": "Cacti through 1.2.7 is affected by a graphs.php?template_id= SQL injection vulnerability affecting how template identifiers are handled when a string and id composite value are used to identify the template type and id. An authenticated attacker can exploit this to extract data from the database, or an unauthenticated remote attacker could exploit this via Cross-Site Request Forgery.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2019-17357",
"url": "https://www.suse.com/security/cve/CVE-2019-17357"
},
{
"category": "external",
"summary": "SUSE Bug 1158990 for CVE-2019-17357",
"url": "https://bugzilla.suse.com/1158990"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2019-17357"
},
{
"cve": "CVE-2019-17358",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2019-17358"
}
],
"notes": [
{
"category": "general",
"text": "Cacti through 1.2.7 is affected by multiple instances of lib/functions.php unsafe deserialization of user-controlled data to populate arrays. An authenticated attacker could use this to influence object data values and control actions taken by Cacti or potentially cause memory corruption in the PHP module.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2019-17358",
"url": "https://www.suse.com/security/cve/CVE-2019-17358"
},
{
"category": "external",
"summary": "SUSE Bug 1158992 for CVE-2019-17358",
"url": "https://bugzilla.suse.com/1158992"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2019-17358"
},
{
"cve": "CVE-2020-11022",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-11022"
}
],
"notes": [
{
"category": "general",
"text": "In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery\u0027s DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-11022",
"url": "https://www.suse.com/security/cve/CVE-2020-11022"
},
{
"category": "external",
"summary": "SUSE Bug 1173090 for CVE-2020-11022",
"url": "https://bugzilla.suse.com/1173090"
},
{
"category": "external",
"summary": "SUSE Bug 1178434 for CVE-2020-11022",
"url": "https://bugzilla.suse.com/1178434"
},
{
"category": "external",
"summary": "SUSE Bug 1190663 for CVE-2020-11022",
"url": "https://bugzilla.suse.com/1190663"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2020-11022"
},
{
"cve": "CVE-2020-13625",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-13625"
}
],
"notes": [
{
"category": "general",
"text": "PHPMailer before 6.1.6 contains an output escaping bug when the name of a file attachment contains a double quote character. This can result in the file type being misinterpreted by the receiver or any mail relay processing the message.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-13625",
"url": "https://www.suse.com/security/cve/CVE-2020-13625"
},
{
"category": "external",
"summary": "SUSE Bug 1173090 for CVE-2020-13625",
"url": "https://bugzilla.suse.com/1173090"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2020-13625"
},
{
"cve": "CVE-2020-14295",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-14295"
}
],
"notes": [
{
"category": "general",
"text": "A SQL injection issue in color.php in Cacti 1.2.12 allows an admin to inject SQL via the filter parameter. This can lead to remote command execution because the product accepts stacked queries.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-14295",
"url": "https://www.suse.com/security/cve/CVE-2020-14295"
},
{
"category": "external",
"summary": "SUSE Bug 1173090 for CVE-2020-14295",
"url": "https://bugzilla.suse.com/1173090"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2020-14295"
},
{
"cve": "CVE-2020-14424",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-14424"
}
],
"notes": [
{
"category": "general",
"text": "Cacti before 1.2.18 allows remote attackers to trigger XSS via template import for the midwinter theme.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-14424",
"url": "https://www.suse.com/security/cve/CVE-2020-14424"
},
{
"category": "external",
"summary": "SUSE Bug 1188188 for CVE-2020-14424",
"url": "https://bugzilla.suse.com/1188188"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2020-14424"
},
{
"cve": "CVE-2020-25706",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-25706"
}
],
"notes": [
{
"category": "general",
"text": "A cross-site scripting (XSS) vulnerability exists in templates_import.php (Cacti 1.2.13) due to Improper escaping of error message during template import preview in the xml_path field",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-25706",
"url": "https://www.suse.com/security/cve/CVE-2020-25706"
},
{
"category": "external",
"summary": "SUSE Bug 1174850 for CVE-2020-25706",
"url": "https://bugzilla.suse.com/1174850"
},
{
"category": "external",
"summary": "SUSE Bug 1178677 for CVE-2020-25706",
"url": "https://bugzilla.suse.com/1178677"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2020-25706"
},
{
"cve": "CVE-2020-35701",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-35701"
}
],
"notes": [
{
"category": "general",
"text": "An issue was discovered in Cacti 1.2.x through 1.2.16. A SQL injection vulnerability in data_debug.php allows remote authenticated attackers to execute arbitrary SQL commands via the site_id parameter. This can lead to remote code execution.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-35701",
"url": "https://www.suse.com/security/cve/CVE-2020-35701"
},
{
"category": "external",
"summary": "SUSE Bug 1180804 for CVE-2020-35701",
"url": "https://bugzilla.suse.com/1180804"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2020-35701"
},
{
"cve": "CVE-2020-7106",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-7106"
}
],
"notes": [
{
"category": "general",
"text": "Cacti 1.2.8 has stored XSS in data_sources.php, color_templates_item.php, graphs.php, graph_items.php, lib/api_automation.php, user_admin.php, and user_group_admin.php, as demonstrated by the description parameter in data_sources.php (a raw string from the database that is displayed by $header to trigger the XSS).",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-7106",
"url": "https://www.suse.com/security/cve/CVE-2020-7106"
},
{
"category": "external",
"summary": "SUSE Bug 1163749 for CVE-2020-7106",
"url": "https://bugzilla.suse.com/1163749"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2020-7106"
},
{
"cve": "CVE-2020-7237",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-7237"
}
],
"notes": [
{
"category": "general",
"text": "Cacti 1.2.8 allows Remote Code Execution (by privileged users) via shell metacharacters in the Performance Boost Debug Log field of poller_automation.php. OS commands are executed when a new poller cycle begins. The attacker must be authenticated, and must have access to modify the Performance Settings of the product.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-7237",
"url": "https://www.suse.com/security/cve/CVE-2020-7237"
},
{
"category": "external",
"summary": "SUSE Bug 1161297 for CVE-2020-7237",
"url": "https://bugzilla.suse.com/1161297"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2020-7237"
},
{
"cve": "CVE-2020-8813",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-8813"
}
],
"notes": [
{
"category": "general",
"text": "graph_realtime.php in Cacti 1.2.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in a cookie, if a guest user has the graph real-time privilege.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-8813",
"url": "https://www.suse.com/security/cve/CVE-2020-8813"
},
{
"category": "external",
"summary": "SUSE Bug 1154087 for CVE-2020-8813",
"url": "https://bugzilla.suse.com/1154087"
},
{
"category": "external",
"summary": "SUSE Bug 1160867 for CVE-2020-8813",
"url": "https://bugzilla.suse.com/1160867"
},
{
"category": "external",
"summary": "SUSE Bug 1164675 for CVE-2020-8813",
"url": "https://bugzilla.suse.com/1164675"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "critical"
}
],
"title": "CVE-2020-8813"
}
]
}
opensuse-su-2020:0558-1
Vulnerability from csaf_opensuse
Published
2020-04-27 18:18
Modified
2020-04-27 18:18
Summary
Security update for cacti, cacti-spine
Notes
Title of the patch
Security update for cacti, cacti-spine
Description of the patch
This update for cacti, cacti-spine to version 1.2.11 fixes the following issues:
This update is fixing multiple vulnerabilities and adding bug fixes. For more details consult the changes file.
Patchnames
openSUSE-2020-558
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for cacti, cacti-spine",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for cacti, cacti-spine to version 1.2.11 fixes the following issues:\n\nThis update is fixing multiple vulnerabilities and adding bug fixes. For more details consult the changes file.\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "openSUSE-2020-558",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2020_0558-1.json"
},
{
"category": "self",
"summary": "URL for openSUSE-SU-2020:0558-1",
"url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/I7VM65WPOCAD6HUODTOBDF4DOY2KSANI/"
},
{
"category": "self",
"summary": "E-Mail link for openSUSE-SU-2020:0558-1",
"url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/I7VM65WPOCAD6HUODTOBDF4DOY2KSANI/"
},
{
"category": "self",
"summary": "SUSE Bug 1082318",
"url": "https://bugzilla.suse.com/1082318"
},
{
"category": "self",
"summary": "SUSE Bug 1122242",
"url": "https://bugzilla.suse.com/1122242"
},
{
"category": "self",
"summary": "SUSE Bug 1122243",
"url": "https://bugzilla.suse.com/1122243"
},
{
"category": "self",
"summary": "SUSE Bug 1122244",
"url": "https://bugzilla.suse.com/1122244"
},
{
"category": "self",
"summary": "SUSE Bug 1122245",
"url": "https://bugzilla.suse.com/1122245"
},
{
"category": "self",
"summary": "SUSE Bug 1122535",
"url": "https://bugzilla.suse.com/1122535"
},
{
"category": "self",
"summary": "SUSE Bug 1158990",
"url": "https://bugzilla.suse.com/1158990"
},
{
"category": "self",
"summary": "SUSE Bug 1158992",
"url": "https://bugzilla.suse.com/1158992"
},
{
"category": "self",
"summary": "SUSE Bug 1161297",
"url": "https://bugzilla.suse.com/1161297"
},
{
"category": "self",
"summary": "SUSE Bug 1164675",
"url": "https://bugzilla.suse.com/1164675"
},
{
"category": "self",
"summary": "SUSE Bug 1169215",
"url": "https://bugzilla.suse.com/1169215"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2009-4112 page",
"url": "https://www.suse.com/security/cve/CVE-2009-4112/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-20723 page",
"url": "https://www.suse.com/security/cve/CVE-2018-20723/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-20724 page",
"url": "https://www.suse.com/security/cve/CVE-2018-20724/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-20725 page",
"url": "https://www.suse.com/security/cve/CVE-2018-20725/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-20726 page",
"url": "https://www.suse.com/security/cve/CVE-2018-20726/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2019-16723 page",
"url": "https://www.suse.com/security/cve/CVE-2019-16723/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2019-17357 page",
"url": "https://www.suse.com/security/cve/CVE-2019-17357/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2019-17358 page",
"url": "https://www.suse.com/security/cve/CVE-2019-17358/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-7106 page",
"url": "https://www.suse.com/security/cve/CVE-2020-7106/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-7237 page",
"url": "https://www.suse.com/security/cve/CVE-2020-7237/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-8813 page",
"url": "https://www.suse.com/security/cve/CVE-2020-8813/"
}
],
"title": "Security update for cacti, cacti-spine",
"tracking": {
"current_release_date": "2020-04-27T18:18:08Z",
"generator": {
"date": "2020-04-27T18:18:08Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "openSUSE-SU-2020:0558-1",
"initial_release_date": "2020-04-27T18:18:08Z",
"revision_history": [
{
"date": "2020-04-27T18:18:08Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "cacti-spine-1.2.11-2.1.aarch64",
"product": {
"name": "cacti-spine-1.2.11-2.1.aarch64",
"product_id": "cacti-spine-1.2.11-2.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "cacti-1.2.11-5.1.noarch",
"product": {
"name": "cacti-1.2.11-5.1.noarch",
"product_id": "cacti-1.2.11-5.1.noarch"
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "cacti-spine-1.2.11-2.1.ppc64le",
"product": {
"name": "cacti-spine-1.2.11-2.1.ppc64le",
"product_id": "cacti-spine-1.2.11-2.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "cacti-spine-1.2.11-2.1.s390x",
"product": {
"name": "cacti-spine-1.2.11-2.1.s390x",
"product_id": "cacti-spine-1.2.11-2.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "cacti-spine-1.2.11-2.1.x86_64",
"product": {
"name": "cacti-spine-1.2.11-2.1.x86_64",
"product_id": "cacti-spine-1.2.11-2.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Package Hub 12",
"product": {
"name": "SUSE Package Hub 12",
"product_id": "SUSE Package Hub 12",
"product_identification_helper": {
"cpe": "cpe:/o:suse:packagehub:12"
}
}
},
{
"category": "product_name",
"name": "openSUSE Leap 15.1",
"product": {
"name": "openSUSE Leap 15.1",
"product_id": "openSUSE Leap 15.1",
"product_identification_helper": {
"cpe": "cpe:/o:opensuse:leap:15.1"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "cacti-1.2.11-5.1.noarch as component of SUSE Package Hub 12",
"product_id": "SUSE Package Hub 12:cacti-1.2.11-5.1.noarch"
},
"product_reference": "cacti-1.2.11-5.1.noarch",
"relates_to_product_reference": "SUSE Package Hub 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cacti-spine-1.2.11-2.1.aarch64 as component of SUSE Package Hub 12",
"product_id": "SUSE Package Hub 12:cacti-spine-1.2.11-2.1.aarch64"
},
"product_reference": "cacti-spine-1.2.11-2.1.aarch64",
"relates_to_product_reference": "SUSE Package Hub 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cacti-spine-1.2.11-2.1.ppc64le as component of SUSE Package Hub 12",
"product_id": "SUSE Package Hub 12:cacti-spine-1.2.11-2.1.ppc64le"
},
"product_reference": "cacti-spine-1.2.11-2.1.ppc64le",
"relates_to_product_reference": "SUSE Package Hub 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cacti-spine-1.2.11-2.1.s390x as component of SUSE Package Hub 12",
"product_id": "SUSE Package Hub 12:cacti-spine-1.2.11-2.1.s390x"
},
"product_reference": "cacti-spine-1.2.11-2.1.s390x",
"relates_to_product_reference": "SUSE Package Hub 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cacti-spine-1.2.11-2.1.x86_64 as component of SUSE Package Hub 12",
"product_id": "SUSE Package Hub 12:cacti-spine-1.2.11-2.1.x86_64"
},
"product_reference": "cacti-spine-1.2.11-2.1.x86_64",
"relates_to_product_reference": "SUSE Package Hub 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cacti-1.2.11-5.1.noarch as component of openSUSE Leap 15.1",
"product_id": "openSUSE Leap 15.1:cacti-1.2.11-5.1.noarch"
},
"product_reference": "cacti-1.2.11-5.1.noarch",
"relates_to_product_reference": "openSUSE Leap 15.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cacti-spine-1.2.11-2.1.aarch64 as component of openSUSE Leap 15.1",
"product_id": "openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.aarch64"
},
"product_reference": "cacti-spine-1.2.11-2.1.aarch64",
"relates_to_product_reference": "openSUSE Leap 15.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cacti-spine-1.2.11-2.1.ppc64le as component of openSUSE Leap 15.1",
"product_id": "openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.ppc64le"
},
"product_reference": "cacti-spine-1.2.11-2.1.ppc64le",
"relates_to_product_reference": "openSUSE Leap 15.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cacti-spine-1.2.11-2.1.s390x as component of openSUSE Leap 15.1",
"product_id": "openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.s390x"
},
"product_reference": "cacti-spine-1.2.11-2.1.s390x",
"relates_to_product_reference": "openSUSE Leap 15.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cacti-spine-1.2.11-2.1.x86_64 as component of openSUSE Leap 15.1",
"product_id": "openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.x86_64"
},
"product_reference": "cacti-spine-1.2.11-2.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.1"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2009-4112",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2009-4112"
}
],
"notes": [
{
"category": "general",
"text": "Cacti 0.8.7e and earlier allows remote authenticated administrators to gain privileges by modifying the \"Data Input Method\" for the \"Linux - Get Memory Usage\" setting to contain arbitrary commands.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Package Hub 12:cacti-1.2.11-5.1.noarch",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.aarch64",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.ppc64le",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.s390x",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.x86_64",
"openSUSE Leap 15.1:cacti-1.2.11-5.1.noarch",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.aarch64",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.ppc64le",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.s390x",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2009-4112",
"url": "https://www.suse.com/security/cve/CVE-2009-4112"
},
{
"category": "external",
"summary": "SUSE Bug 1122535 for CVE-2009-4112",
"url": "https://bugzilla.suse.com/1122535"
},
{
"category": "external",
"summary": "SUSE Bug 558664 for CVE-2009-4112",
"url": "https://bugzilla.suse.com/558664"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Package Hub 12:cacti-1.2.11-5.1.noarch",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.aarch64",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.ppc64le",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.s390x",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.x86_64",
"openSUSE Leap 15.1:cacti-1.2.11-5.1.noarch",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.aarch64",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.ppc64le",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.s390x",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-04-27T18:18:08Z",
"details": "important"
}
],
"title": "CVE-2009-4112"
},
{
"cve": "CVE-2018-20723",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-20723"
}
],
"notes": [
{
"category": "general",
"text": "A cross-site scripting (XSS) vulnerability exists in color_templates.php in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Name field for a Color.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Package Hub 12:cacti-1.2.11-5.1.noarch",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.aarch64",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.ppc64le",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.s390x",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.x86_64",
"openSUSE Leap 15.1:cacti-1.2.11-5.1.noarch",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.aarch64",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.ppc64le",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.s390x",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-20723",
"url": "https://www.suse.com/security/cve/CVE-2018-20723"
},
{
"category": "external",
"summary": "SUSE Bug 1122245 for CVE-2018-20723",
"url": "https://bugzilla.suse.com/1122245"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Package Hub 12:cacti-1.2.11-5.1.noarch",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.aarch64",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.ppc64le",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.s390x",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.x86_64",
"openSUSE Leap 15.1:cacti-1.2.11-5.1.noarch",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.aarch64",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.ppc64le",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.s390x",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"SUSE Package Hub 12:cacti-1.2.11-5.1.noarch",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.aarch64",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.ppc64le",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.s390x",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.x86_64",
"openSUSE Leap 15.1:cacti-1.2.11-5.1.noarch",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.aarch64",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.ppc64le",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.s390x",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-04-27T18:18:08Z",
"details": "moderate"
}
],
"title": "CVE-2018-20723"
},
{
"cve": "CVE-2018-20724",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-20724"
}
],
"notes": [
{
"category": "general",
"text": "A cross-site scripting (XSS) vulnerability exists in pollers.php in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Website Hostname for Data Collectors.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Package Hub 12:cacti-1.2.11-5.1.noarch",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.aarch64",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.ppc64le",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.s390x",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.x86_64",
"openSUSE Leap 15.1:cacti-1.2.11-5.1.noarch",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.aarch64",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.ppc64le",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.s390x",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-20724",
"url": "https://www.suse.com/security/cve/CVE-2018-20724"
},
{
"category": "external",
"summary": "SUSE Bug 1122244 for CVE-2018-20724",
"url": "https://bugzilla.suse.com/1122244"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Package Hub 12:cacti-1.2.11-5.1.noarch",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.aarch64",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.ppc64le",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.s390x",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.x86_64",
"openSUSE Leap 15.1:cacti-1.2.11-5.1.noarch",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.aarch64",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.ppc64le",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.s390x",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"SUSE Package Hub 12:cacti-1.2.11-5.1.noarch",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.aarch64",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.ppc64le",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.s390x",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.x86_64",
"openSUSE Leap 15.1:cacti-1.2.11-5.1.noarch",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.aarch64",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.ppc64le",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.s390x",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-04-27T18:18:08Z",
"details": "moderate"
}
],
"title": "CVE-2018-20724"
},
{
"cve": "CVE-2018-20725",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-20725"
}
],
"notes": [
{
"category": "general",
"text": "A cross-site scripting (XSS) vulnerability exists in graph_templates.php in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Graph Vertical Label.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Package Hub 12:cacti-1.2.11-5.1.noarch",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.aarch64",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.ppc64le",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.s390x",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.x86_64",
"openSUSE Leap 15.1:cacti-1.2.11-5.1.noarch",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.aarch64",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.ppc64le",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.s390x",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-20725",
"url": "https://www.suse.com/security/cve/CVE-2018-20725"
},
{
"category": "external",
"summary": "SUSE Bug 1122243 for CVE-2018-20725",
"url": "https://bugzilla.suse.com/1122243"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Package Hub 12:cacti-1.2.11-5.1.noarch",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.aarch64",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.ppc64le",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.s390x",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.x86_64",
"openSUSE Leap 15.1:cacti-1.2.11-5.1.noarch",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.aarch64",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.ppc64le",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.s390x",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"SUSE Package Hub 12:cacti-1.2.11-5.1.noarch",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.aarch64",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.ppc64le",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.s390x",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.x86_64",
"openSUSE Leap 15.1:cacti-1.2.11-5.1.noarch",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.aarch64",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.ppc64le",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.s390x",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-04-27T18:18:08Z",
"details": "moderate"
}
],
"title": "CVE-2018-20725"
},
{
"cve": "CVE-2018-20726",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-20726"
}
],
"notes": [
{
"category": "general",
"text": "A cross-site scripting (XSS) vulnerability exists in host.php (via tree.php) in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Website Hostname field for Devices.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Package Hub 12:cacti-1.2.11-5.1.noarch",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.aarch64",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.ppc64le",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.s390x",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.x86_64",
"openSUSE Leap 15.1:cacti-1.2.11-5.1.noarch",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.aarch64",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.ppc64le",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.s390x",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-20726",
"url": "https://www.suse.com/security/cve/CVE-2018-20726"
},
{
"category": "external",
"summary": "SUSE Bug 1122242 for CVE-2018-20726",
"url": "https://bugzilla.suse.com/1122242"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Package Hub 12:cacti-1.2.11-5.1.noarch",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.aarch64",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.ppc64le",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.s390x",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.x86_64",
"openSUSE Leap 15.1:cacti-1.2.11-5.1.noarch",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.aarch64",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.ppc64le",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.s390x",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"SUSE Package Hub 12:cacti-1.2.11-5.1.noarch",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.aarch64",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.ppc64le",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.s390x",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.x86_64",
"openSUSE Leap 15.1:cacti-1.2.11-5.1.noarch",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.aarch64",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.ppc64le",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.s390x",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-04-27T18:18:08Z",
"details": "moderate"
}
],
"title": "CVE-2018-20726"
},
{
"cve": "CVE-2019-16723",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2019-16723"
}
],
"notes": [
{
"category": "general",
"text": "In Cacti through 1.2.6, authenticated users may bypass authorization checks (for viewing a graph) via a direct graph_json.php request with a modified local_graph_id parameter.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Package Hub 12:cacti-1.2.11-5.1.noarch",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.aarch64",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.ppc64le",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.s390x",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.x86_64",
"openSUSE Leap 15.1:cacti-1.2.11-5.1.noarch",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.aarch64",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.ppc64le",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.s390x",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2019-16723",
"url": "https://www.suse.com/security/cve/CVE-2019-16723"
},
{
"category": "external",
"summary": "SUSE Bug 1151788 for CVE-2019-16723",
"url": "https://bugzilla.suse.com/1151788"
},
{
"category": "external",
"summary": "SUSE Bug 1214170 for CVE-2019-16723",
"url": "https://bugzilla.suse.com/1214170"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Package Hub 12:cacti-1.2.11-5.1.noarch",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.aarch64",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.ppc64le",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.s390x",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.x86_64",
"openSUSE Leap 15.1:cacti-1.2.11-5.1.noarch",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.aarch64",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.ppc64le",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.s390x",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"SUSE Package Hub 12:cacti-1.2.11-5.1.noarch",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.aarch64",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.ppc64le",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.s390x",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.x86_64",
"openSUSE Leap 15.1:cacti-1.2.11-5.1.noarch",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.aarch64",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.ppc64le",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.s390x",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-04-27T18:18:08Z",
"details": "moderate"
}
],
"title": "CVE-2019-16723"
},
{
"cve": "CVE-2019-17357",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2019-17357"
}
],
"notes": [
{
"category": "general",
"text": "Cacti through 1.2.7 is affected by a graphs.php?template_id= SQL injection vulnerability affecting how template identifiers are handled when a string and id composite value are used to identify the template type and id. An authenticated attacker can exploit this to extract data from the database, or an unauthenticated remote attacker could exploit this via Cross-Site Request Forgery.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Package Hub 12:cacti-1.2.11-5.1.noarch",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.aarch64",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.ppc64le",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.s390x",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.x86_64",
"openSUSE Leap 15.1:cacti-1.2.11-5.1.noarch",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.aarch64",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.ppc64le",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.s390x",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2019-17357",
"url": "https://www.suse.com/security/cve/CVE-2019-17357"
},
{
"category": "external",
"summary": "SUSE Bug 1158990 for CVE-2019-17357",
"url": "https://bugzilla.suse.com/1158990"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Package Hub 12:cacti-1.2.11-5.1.noarch",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.aarch64",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.ppc64le",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.s390x",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.x86_64",
"openSUSE Leap 15.1:cacti-1.2.11-5.1.noarch",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.aarch64",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.ppc64le",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.s390x",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"SUSE Package Hub 12:cacti-1.2.11-5.1.noarch",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.aarch64",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.ppc64le",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.s390x",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.x86_64",
"openSUSE Leap 15.1:cacti-1.2.11-5.1.noarch",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.aarch64",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.ppc64le",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.s390x",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-04-27T18:18:08Z",
"details": "important"
}
],
"title": "CVE-2019-17357"
},
{
"cve": "CVE-2019-17358",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2019-17358"
}
],
"notes": [
{
"category": "general",
"text": "Cacti through 1.2.7 is affected by multiple instances of lib/functions.php unsafe deserialization of user-controlled data to populate arrays. An authenticated attacker could use this to influence object data values and control actions taken by Cacti or potentially cause memory corruption in the PHP module.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Package Hub 12:cacti-1.2.11-5.1.noarch",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.aarch64",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.ppc64le",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.s390x",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.x86_64",
"openSUSE Leap 15.1:cacti-1.2.11-5.1.noarch",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.aarch64",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.ppc64le",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.s390x",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2019-17358",
"url": "https://www.suse.com/security/cve/CVE-2019-17358"
},
{
"category": "external",
"summary": "SUSE Bug 1158992 for CVE-2019-17358",
"url": "https://bugzilla.suse.com/1158992"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Package Hub 12:cacti-1.2.11-5.1.noarch",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.aarch64",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.ppc64le",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.s390x",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.x86_64",
"openSUSE Leap 15.1:cacti-1.2.11-5.1.noarch",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.aarch64",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.ppc64le",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.s390x",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Package Hub 12:cacti-1.2.11-5.1.noarch",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.aarch64",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.ppc64le",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.s390x",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.x86_64",
"openSUSE Leap 15.1:cacti-1.2.11-5.1.noarch",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.aarch64",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.ppc64le",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.s390x",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-04-27T18:18:08Z",
"details": "moderate"
}
],
"title": "CVE-2019-17358"
},
{
"cve": "CVE-2020-7106",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-7106"
}
],
"notes": [
{
"category": "general",
"text": "Cacti 1.2.8 has stored XSS in data_sources.php, color_templates_item.php, graphs.php, graph_items.php, lib/api_automation.php, user_admin.php, and user_group_admin.php, as demonstrated by the description parameter in data_sources.php (a raw string from the database that is displayed by $header to trigger the XSS).",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Package Hub 12:cacti-1.2.11-5.1.noarch",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.aarch64",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.ppc64le",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.s390x",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.x86_64",
"openSUSE Leap 15.1:cacti-1.2.11-5.1.noarch",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.aarch64",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.ppc64le",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.s390x",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-7106",
"url": "https://www.suse.com/security/cve/CVE-2020-7106"
},
{
"category": "external",
"summary": "SUSE Bug 1163749 for CVE-2020-7106",
"url": "https://bugzilla.suse.com/1163749"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Package Hub 12:cacti-1.2.11-5.1.noarch",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.aarch64",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.ppc64le",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.s390x",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.x86_64",
"openSUSE Leap 15.1:cacti-1.2.11-5.1.noarch",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.aarch64",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.ppc64le",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.s390x",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Package Hub 12:cacti-1.2.11-5.1.noarch",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.aarch64",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.ppc64le",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.s390x",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.x86_64",
"openSUSE Leap 15.1:cacti-1.2.11-5.1.noarch",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.aarch64",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.ppc64le",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.s390x",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-04-27T18:18:08Z",
"details": "moderate"
}
],
"title": "CVE-2020-7106"
},
{
"cve": "CVE-2020-7237",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-7237"
}
],
"notes": [
{
"category": "general",
"text": "Cacti 1.2.8 allows Remote Code Execution (by privileged users) via shell metacharacters in the Performance Boost Debug Log field of poller_automation.php. OS commands are executed when a new poller cycle begins. The attacker must be authenticated, and must have access to modify the Performance Settings of the product.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Package Hub 12:cacti-1.2.11-5.1.noarch",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.aarch64",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.ppc64le",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.s390x",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.x86_64",
"openSUSE Leap 15.1:cacti-1.2.11-5.1.noarch",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.aarch64",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.ppc64le",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.s390x",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-7237",
"url": "https://www.suse.com/security/cve/CVE-2020-7237"
},
{
"category": "external",
"summary": "SUSE Bug 1161297 for CVE-2020-7237",
"url": "https://bugzilla.suse.com/1161297"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Package Hub 12:cacti-1.2.11-5.1.noarch",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.aarch64",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.ppc64le",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.s390x",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.x86_64",
"openSUSE Leap 15.1:cacti-1.2.11-5.1.noarch",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.aarch64",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.ppc64le",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.s390x",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Package Hub 12:cacti-1.2.11-5.1.noarch",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.aarch64",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.ppc64le",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.s390x",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.x86_64",
"openSUSE Leap 15.1:cacti-1.2.11-5.1.noarch",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.aarch64",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.ppc64le",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.s390x",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-04-27T18:18:08Z",
"details": "important"
}
],
"title": "CVE-2020-7237"
},
{
"cve": "CVE-2020-8813",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-8813"
}
],
"notes": [
{
"category": "general",
"text": "graph_realtime.php in Cacti 1.2.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in a cookie, if a guest user has the graph real-time privilege.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Package Hub 12:cacti-1.2.11-5.1.noarch",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.aarch64",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.ppc64le",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.s390x",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.x86_64",
"openSUSE Leap 15.1:cacti-1.2.11-5.1.noarch",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.aarch64",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.ppc64le",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.s390x",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-8813",
"url": "https://www.suse.com/security/cve/CVE-2020-8813"
},
{
"category": "external",
"summary": "SUSE Bug 1154087 for CVE-2020-8813",
"url": "https://bugzilla.suse.com/1154087"
},
{
"category": "external",
"summary": "SUSE Bug 1160867 for CVE-2020-8813",
"url": "https://bugzilla.suse.com/1160867"
},
{
"category": "external",
"summary": "SUSE Bug 1164675 for CVE-2020-8813",
"url": "https://bugzilla.suse.com/1164675"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Package Hub 12:cacti-1.2.11-5.1.noarch",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.aarch64",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.ppc64le",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.s390x",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.x86_64",
"openSUSE Leap 15.1:cacti-1.2.11-5.1.noarch",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.aarch64",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.ppc64le",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.s390x",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Package Hub 12:cacti-1.2.11-5.1.noarch",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.aarch64",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.ppc64le",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.s390x",
"SUSE Package Hub 12:cacti-spine-1.2.11-2.1.x86_64",
"openSUSE Leap 15.1:cacti-1.2.11-5.1.noarch",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.aarch64",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.ppc64le",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.s390x",
"openSUSE Leap 15.1:cacti-spine-1.2.11-2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-04-27T18:18:08Z",
"details": "critical"
}
],
"title": "CVE-2020-8813"
}
]
}
wid-sec-w-2023-0006
Vulnerability from csaf_certbund
Published
2020-02-23 23:00
Modified
2023-01-01 23:00
Summary
Cacti RRDtool: Schwachstelle ermöglicht Ausführen von beliebigem Programmcode mit den Rechten des Dienstes
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung
Cacti ist ein grafisches Frontend zur Visualisierung von statistischen Daten, erfasst durch die Round Robin Database rrdtool.
Angriff
Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Cacti RRDtool ausnutzen, um beliebigen Programmcode mit den Rechten des Dienstes auszuführen.
Betroffene Betriebssysteme
- UNIX
- Linux
- MacOS X
- Windows
{
"document": {
"aggregate_severity": {
"text": "mittel"
},
"category": "csaf_base",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "de-DE",
"notes": [
{
"category": "legal_disclaimer",
"text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
},
{
"category": "description",
"text": "Cacti ist ein grafisches Frontend zur Visualisierung von statistischen Daten, erfasst durch die Round Robin Database rrdtool.",
"title": "Produktbeschreibung"
},
{
"category": "summary",
"text": "Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Cacti RRDtool ausnutzen, um beliebigen Programmcode mit den Rechten des Dienstes auszuf\u00fchren.",
"title": "Angriff"
},
{
"category": "general",
"text": "- UNIX\n- Linux\n- MacOS X\n- Windows",
"title": "Betroffene Betriebssysteme"
}
],
"publisher": {
"category": "other",
"contact_details": "csaf-provider@cert-bund.de",
"name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
"namespace": "https://www.bsi.bund.de"
},
"references": [
{
"category": "self",
"summary": "WID-SEC-W-2023-0006 - CSAF Version",
"url": "https://wid.cert-bund.de/.well-known/csaf/white/2020/wid-sec-w-2023-0006.json"
},
{
"category": "self",
"summary": "WID-SEC-2023-0006 - Portal Version",
"url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-0006"
},
{
"category": "external",
"summary": "Debian Security Advisory DLA-3252 vom 2022-12-31",
"url": "https://lists.debian.org/debian-lts-announce/2022/12/msg00039.html"
},
{
"category": "external",
"summary": "NIST Database vom 2020-02-23",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8813"
},
{
"category": "external",
"summary": "GENTOO Security Advisory GLSA/202004-16 vom 2020-05-01",
"url": "https://security.gentoo.org/glsa/202004-16"
}
],
"source_lang": "en-US",
"title": "Cacti RRDtool: Schwachstelle erm\u00f6glicht Ausf\u00fchren von beliebigem Programmcode mit den Rechten des Dienstes",
"tracking": {
"current_release_date": "2023-01-01T23:00:00.000+00:00",
"generator": {
"date": "2024-08-15T17:40:39.010+00:00",
"engine": {
"name": "BSI-WID",
"version": "1.3.5"
}
},
"id": "WID-SEC-W-2023-0006",
"initial_release_date": "2020-02-23T23:00:00.000+00:00",
"revision_history": [
{
"date": "2020-02-23T23:00:00.000+00:00",
"number": "1",
"summary": "Initiale Fassung"
},
{
"date": "2020-03-02T23:00:00.000+00:00",
"number": "2",
"summary": "Referenz(en) aufgenommen: FEDORA-2020-10FE60D68B, FEDORA-2020-552E4E7879, FEDORA-2020-D6A9E27BB1"
},
{
"date": "2020-05-03T22:00:00.000+00:00",
"number": "3",
"summary": "Neue Updates von GENTOO aufgenommen"
},
{
"date": "2023-01-01T23:00:00.000+00:00",
"number": "4",
"summary": "Neue Updates von Debian aufgenommen"
}
],
"status": "final",
"version": "4"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Debian Linux",
"product": {
"name": "Debian Linux",
"product_id": "2951",
"product_identification_helper": {
"cpe": "cpe:/o:debian:debian_linux:-"
}
}
}
],
"category": "vendor",
"name": "Debian"
},
{
"branches": [
{
"category": "product_name",
"name": "Gentoo Linux",
"product": {
"name": "Gentoo Linux",
"product_id": "T012167",
"product_identification_helper": {
"cpe": "cpe:/o:gentoo:linux:-"
}
}
}
],
"category": "vendor",
"name": "Gentoo"
},
{
"branches": [
{
"category": "product_name",
"name": "Open Source Cacti 1.2.8",
"product": {
"name": "Open Source Cacti 1.2.8",
"product_id": "675186",
"product_identification_helper": {
"cpe": "cpe:/a:cacti:cacti:1.2.8"
}
}
}
],
"category": "vendor",
"name": "Open Source"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2020-8813",
"notes": [
{
"category": "description",
"text": "Es existiert eine Schwachstelle in Cacti RRDtool. Die Schwachstelle besteht darin, dass als Gast Cookies manipuliert werden k\u00f6nnen, um beliebigen Programmcode auszuf\u00fchren. F\u00fcr eine Ausnutzung muss der Gast das Recht zur Ansicht von Graphen besitzen. Zur Aktivierung dieser Option muss sich der Angreifer jedoch authentisieren. Ein entfernter, authentisierter Angreifer kann diese Schwachstelle ausnutzen, um beliebigen Programmcode mit Rechten des Dienstes auszuf\u00fchren."
}
],
"product_status": {
"known_affected": [
"2951",
"T012167",
"675186"
]
},
"release_date": "2020-02-23T23:00:00.000+00:00",
"title": "CVE-2020-8813"
}
]
}
WID-SEC-W-2023-0006
Vulnerability from csaf_certbund
Published
2020-02-23 23:00
Modified
2023-01-01 23:00
Summary
Cacti RRDtool: Schwachstelle ermöglicht Ausführen von beliebigem Programmcode mit den Rechten des Dienstes
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung
Cacti ist ein grafisches Frontend zur Visualisierung von statistischen Daten, erfasst durch die Round Robin Database rrdtool.
Angriff
Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Cacti RRDtool ausnutzen, um beliebigen Programmcode mit den Rechten des Dienstes auszuführen.
Betroffene Betriebssysteme
- UNIX
- Linux
- MacOS X
- Windows
{
"document": {
"aggregate_severity": {
"text": "mittel"
},
"category": "csaf_base",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "de-DE",
"notes": [
{
"category": "legal_disclaimer",
"text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
},
{
"category": "description",
"text": "Cacti ist ein grafisches Frontend zur Visualisierung von statistischen Daten, erfasst durch die Round Robin Database rrdtool.",
"title": "Produktbeschreibung"
},
{
"category": "summary",
"text": "Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Cacti RRDtool ausnutzen, um beliebigen Programmcode mit den Rechten des Dienstes auszuf\u00fchren.",
"title": "Angriff"
},
{
"category": "general",
"text": "- UNIX\n- Linux\n- MacOS X\n- Windows",
"title": "Betroffene Betriebssysteme"
}
],
"publisher": {
"category": "other",
"contact_details": "csaf-provider@cert-bund.de",
"name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
"namespace": "https://www.bsi.bund.de"
},
"references": [
{
"category": "self",
"summary": "WID-SEC-W-2023-0006 - CSAF Version",
"url": "https://wid.cert-bund.de/.well-known/csaf/white/2020/wid-sec-w-2023-0006.json"
},
{
"category": "self",
"summary": "WID-SEC-2023-0006 - Portal Version",
"url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-0006"
},
{
"category": "external",
"summary": "Debian Security Advisory DLA-3252 vom 2022-12-31",
"url": "https://lists.debian.org/debian-lts-announce/2022/12/msg00039.html"
},
{
"category": "external",
"summary": "NIST Database vom 2020-02-23",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8813"
},
{
"category": "external",
"summary": "GENTOO Security Advisory GLSA/202004-16 vom 2020-05-01",
"url": "https://security.gentoo.org/glsa/202004-16"
}
],
"source_lang": "en-US",
"title": "Cacti RRDtool: Schwachstelle erm\u00f6glicht Ausf\u00fchren von beliebigem Programmcode mit den Rechten des Dienstes",
"tracking": {
"current_release_date": "2023-01-01T23:00:00.000+00:00",
"generator": {
"date": "2024-08-15T17:40:39.010+00:00",
"engine": {
"name": "BSI-WID",
"version": "1.3.5"
}
},
"id": "WID-SEC-W-2023-0006",
"initial_release_date": "2020-02-23T23:00:00.000+00:00",
"revision_history": [
{
"date": "2020-02-23T23:00:00.000+00:00",
"number": "1",
"summary": "Initiale Fassung"
},
{
"date": "2020-03-02T23:00:00.000+00:00",
"number": "2",
"summary": "Referenz(en) aufgenommen: FEDORA-2020-10FE60D68B, FEDORA-2020-552E4E7879, FEDORA-2020-D6A9E27BB1"
},
{
"date": "2020-05-03T22:00:00.000+00:00",
"number": "3",
"summary": "Neue Updates von GENTOO aufgenommen"
},
{
"date": "2023-01-01T23:00:00.000+00:00",
"number": "4",
"summary": "Neue Updates von Debian aufgenommen"
}
],
"status": "final",
"version": "4"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Debian Linux",
"product": {
"name": "Debian Linux",
"product_id": "2951",
"product_identification_helper": {
"cpe": "cpe:/o:debian:debian_linux:-"
}
}
}
],
"category": "vendor",
"name": "Debian"
},
{
"branches": [
{
"category": "product_name",
"name": "Gentoo Linux",
"product": {
"name": "Gentoo Linux",
"product_id": "T012167",
"product_identification_helper": {
"cpe": "cpe:/o:gentoo:linux:-"
}
}
}
],
"category": "vendor",
"name": "Gentoo"
},
{
"branches": [
{
"category": "product_name",
"name": "Open Source Cacti 1.2.8",
"product": {
"name": "Open Source Cacti 1.2.8",
"product_id": "675186",
"product_identification_helper": {
"cpe": "cpe:/a:cacti:cacti:1.2.8"
}
}
}
],
"category": "vendor",
"name": "Open Source"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2020-8813",
"notes": [
{
"category": "description",
"text": "Es existiert eine Schwachstelle in Cacti RRDtool. Die Schwachstelle besteht darin, dass als Gast Cookies manipuliert werden k\u00f6nnen, um beliebigen Programmcode auszuf\u00fchren. F\u00fcr eine Ausnutzung muss der Gast das Recht zur Ansicht von Graphen besitzen. Zur Aktivierung dieser Option muss sich der Angreifer jedoch authentisieren. Ein entfernter, authentisierter Angreifer kann diese Schwachstelle ausnutzen, um beliebigen Programmcode mit Rechten des Dienstes auszuf\u00fchren."
}
],
"product_status": {
"known_affected": [
"2951",
"T012167",
"675186"
]
},
"release_date": "2020-02-23T23:00:00.000+00:00",
"title": "CVE-2020-8813"
}
]
}
ghsa-gg99-fwr4-rcj9
Vulnerability from github
Published
2022-05-24 17:09
Modified
2022-05-25 00:00
Severity ?
Details
graph_realtime.php in Cacti 1.2.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in a cookie, if a guest user has the graph real-time privilege.
{
"affected": [],
"aliases": [
"CVE-2020-8813"
],
"database_specific": {
"cwe_ids": [
"CWE-78"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-02-22T02:15:00Z",
"severity": "HIGH"
},
"details": "graph_realtime.php in Cacti 1.2.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in a cookie, if a guest user has the graph real-time privilege.",
"id": "GHSA-gg99-fwr4-rcj9",
"modified": "2022-05-25T00:00:23Z",
"published": "2022-05-24T17:09:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8813"
},
{
"type": "WEB",
"url": "https://github.com/Cacti/cacti/issues/3285"
},
{
"type": "WEB",
"url": "https://drive.google.com/file/d/1A8hxTyk_NgSp04zPX-23nPbsSDeyDFio/view"
},
{
"type": "WEB",
"url": "https://gist.github.com/mhaskar/ebe6b74c32fd0f7e1eedf1aabfd44129"
},
{
"type": "WEB",
"url": "https://github.com/Cacti/cacti/releases"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2022/12/msg00039.html"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M77SS33IDVNGBU566TK2XVULPW3RXUQ4"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WAX3LDXPIKWNBGVZSIMZV7LI5K6BZRTO"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XEMDQXDRNQYXOME7TACKDVCXZXZNGZE2"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/202004-16"
},
{
"type": "WEB",
"url": "https://shells.systems/cacti-v1-2-8-authenticated-remote-code-execution-cve-2020-8813"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00042.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00048.html"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/156537/Cacti-1.2.8-Unauthenticated-Remote-Code-Execution.html"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/156538/Cacti-1.2.8-Authenticated-Remote-Code-Execution.html"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/156593/Cacti-1.2.8-Unauthenticated-Remote-Code-Execution.html"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/157477/Open-AudIT-Professional-3.3.1-Remote-Code-Execution.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
gsd-2020-8813
Vulnerability from gsd
Modified
2023-12-13 01:21
Details
graph_realtime.php in Cacti 1.2.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in a cookie, if a guest user has the graph real-time privilege.
Aliases
Aliases
{
"GSD": {
"alias": "CVE-2020-8813",
"description": "graph_realtime.php in Cacti 1.2.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in a cookie, if a guest user has the graph real-time privilege.",
"id": "GSD-2020-8813",
"references": [
"https://www.suse.com/security/cve/CVE-2020-8813.html",
"https://packetstormsecurity.com/files/cve/CVE-2020-8813"
]
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"aliases": [
"CVE-2020-8813"
],
"details": "graph_realtime.php in Cacti 1.2.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in a cookie, if a guest user has the graph real-time privilege.",
"id": "GSD-2020-8813",
"modified": "2023-12-13T01:21:53.550596Z",
"schema_version": "1.4.0"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2020-8813",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "graph_realtime.php in Cacti 1.2.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in a cookie, if a guest user has the graph real-time privilege."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://gist.github.com/mhaskar/ebe6b74c32fd0f7e1eedf1aabfd44129",
"refsource": "MISC",
"url": "https://gist.github.com/mhaskar/ebe6b74c32fd0f7e1eedf1aabfd44129"
},
{
"name": "https://drive.google.com/file/d/1A8hxTyk_NgSp04zPX-23nPbsSDeyDFio/view",
"refsource": "MISC",
"url": "https://drive.google.com/file/d/1A8hxTyk_NgSp04zPX-23nPbsSDeyDFio/view"
},
{
"name": "https://github.com/Cacti/cacti/releases",
"refsource": "MISC",
"url": "https://github.com/Cacti/cacti/releases"
},
{
"name": "https://shells.systems/cacti-v1-2-8-authenticated-remote-code-execution-cve-2020-8813/",
"refsource": "MISC",
"url": "https://shells.systems/cacti-v1-2-8-authenticated-remote-code-execution-cve-2020-8813/"
},
{
"name": "https://github.com/Cacti/cacti/issues/3285",
"refsource": "CONFIRM",
"url": "https://github.com/Cacti/cacti/issues/3285"
},
{
"name": "http://packetstormsecurity.com/files/156538/Cacti-1.2.8-Authenticated-Remote-Code-Execution.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/156538/Cacti-1.2.8-Authenticated-Remote-Code-Execution.html"
},
{
"name": "http://packetstormsecurity.com/files/156537/Cacti-1.2.8-Unauthenticated-Remote-Code-Execution.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/156537/Cacti-1.2.8-Unauthenticated-Remote-Code-Execution.html"
},
{
"name": "http://packetstormsecurity.com/files/156593/Cacti-1.2.8-Unauthenticated-Remote-Code-Execution.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/156593/Cacti-1.2.8-Unauthenticated-Remote-Code-Execution.html"
},
{
"name": "FEDORA-2020-552e4e7879",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M77SS33IDVNGBU566TK2XVULPW3RXUQ4/"
},
{
"name": "FEDORA-2020-10fe60d68b",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XEMDQXDRNQYXOME7TACKDVCXZXZNGZE2/"
},
{
"name": "FEDORA-2020-d6a9e27bb1",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WAX3LDXPIKWNBGVZSIMZV7LI5K6BZRTO/"
},
{
"name": "openSUSE-SU-2020:0558",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00042.html"
},
{
"name": "http://packetstormsecurity.com/files/157477/Open-AudIT-Professional-3.3.1-Remote-Code-Execution.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/157477/Open-AudIT-Professional-3.3.1-Remote-Code-Execution.html"
},
{
"name": "openSUSE-SU-2020:0565",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00048.html"
},
{
"name": "GLSA-202004-16",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/202004-16"
},
{
"name": "[debian-lts-announce] 20221231 [SECURITY] [DLA 3252-1] cacti security update",
"refsource": "MLIST",
"url": "https://lists.debian.org/debian-lts-announce/2022/12/msg00039.html"
}
]
}
},
"nvd.nist.gov": {
"configurations": {
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:cacti:cacti:1.2.8:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:opmantek:open-audit:3.3.1:*:*:*:-:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:opensuse:suse_package_hub:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:opensuse:suse_linux_enterprise_server:12.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
},
"cve": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2020-8813"
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "en",
"value": "graph_realtime.php in Cacti 1.2.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in a cookie, if a guest user has the graph real-time privilege."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "en",
"value": "CWE-78"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/Cacti/cacti/releases",
"refsource": "MISC",
"tags": [
"Release Notes"
],
"url": "https://github.com/Cacti/cacti/releases"
},
{
"name": "https://gist.github.com/mhaskar/ebe6b74c32fd0f7e1eedf1aabfd44129",
"refsource": "MISC",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://gist.github.com/mhaskar/ebe6b74c32fd0f7e1eedf1aabfd44129"
},
{
"name": "https://drive.google.com/file/d/1A8hxTyk_NgSp04zPX-23nPbsSDeyDFio/view",
"refsource": "MISC",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://drive.google.com/file/d/1A8hxTyk_NgSp04zPX-23nPbsSDeyDFio/view"
},
{
"name": "https://shells.systems/cacti-v1-2-8-authenticated-remote-code-execution-cve-2020-8813/",
"refsource": "MISC",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://shells.systems/cacti-v1-2-8-authenticated-remote-code-execution-cve-2020-8813/"
},
{
"name": "https://github.com/Cacti/cacti/issues/3285",
"refsource": "CONFIRM",
"tags": [
"Issue Tracking",
"Third Party Advisory"
],
"url": "https://github.com/Cacti/cacti/issues/3285"
},
{
"name": "http://packetstormsecurity.com/files/156538/Cacti-1.2.8-Authenticated-Remote-Code-Execution.html",
"refsource": "MISC",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://packetstormsecurity.com/files/156538/Cacti-1.2.8-Authenticated-Remote-Code-Execution.html"
},
{
"name": "http://packetstormsecurity.com/files/156537/Cacti-1.2.8-Unauthenticated-Remote-Code-Execution.html",
"refsource": "MISC",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://packetstormsecurity.com/files/156537/Cacti-1.2.8-Unauthenticated-Remote-Code-Execution.html"
},
{
"name": "http://packetstormsecurity.com/files/156593/Cacti-1.2.8-Unauthenticated-Remote-Code-Execution.html",
"refsource": "MISC",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://packetstormsecurity.com/files/156593/Cacti-1.2.8-Unauthenticated-Remote-Code-Execution.html"
},
{
"name": "FEDORA-2020-552e4e7879",
"refsource": "FEDORA",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M77SS33IDVNGBU566TK2XVULPW3RXUQ4/"
},
{
"name": "FEDORA-2020-10fe60d68b",
"refsource": "FEDORA",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XEMDQXDRNQYXOME7TACKDVCXZXZNGZE2/"
},
{
"name": "FEDORA-2020-d6a9e27bb1",
"refsource": "FEDORA",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WAX3LDXPIKWNBGVZSIMZV7LI5K6BZRTO/"
},
{
"name": "openSUSE-SU-2020:0558",
"refsource": "SUSE",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00042.html"
},
{
"name": "http://packetstormsecurity.com/files/157477/Open-AudIT-Professional-3.3.1-Remote-Code-Execution.html",
"refsource": "MISC",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://packetstormsecurity.com/files/157477/Open-AudIT-Professional-3.3.1-Remote-Code-Execution.html"
},
{
"name": "openSUSE-SU-2020:0565",
"refsource": "SUSE",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00048.html"
},
{
"name": "GLSA-202004-16",
"refsource": "GENTOO",
"tags": [
"Third Party Advisory"
],
"url": "https://security.gentoo.org/glsa/202004-16"
},
{
"name": "[debian-lts-announce] 20221231 [SECURITY] [DLA 3252-1] cacti security update",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.debian.org/debian-lts-announce/2022/12/msg00039.html"
}
]
}
},
"impact": {
"baseMetricV2": {
"acInsufInfo": false,
"cvssV2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 9.3,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 10.0,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"userInteractionRequired": false
},
"baseMetricV3": {
"cvssV3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9
}
},
"lastModifiedDate": "2023-02-28T19:23Z",
"publishedDate": "2020-02-22T02:15Z"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.