Cacti before 1.0.0 allows remote authenticated users to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted serialized object, related to calling unserialize(stripslashes()).

The remote host is affected by the vulnerability described in GLSA-201711-10 (Cacti: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Cacti. Please review       the CVE identifiers referenced below for details.
  Impact :

    Remote attackers could execute arbitrary code or bypass intended access       restrictions.
  Workaround :

    There is no known workaround at this time.

PHP Object Injection Vulnerabilities (CVE-2014-4000)

This update for cacti fixes the following vulnerabilities :

  - CVE-2014-4000: PHP Object Injection Vulnerabilities     (boo#1022564)

It also updates cacti to version 1.0.4 to include the latest upstream bugfixes and improvements.

- Update to 1.0.4

Release notes :

http://www.cacti.net/release_notes_1_0_0.php

http://www.cacti.net/release_notes_1_0_1.php

http://www.cacti.net/release_notes_1_0_2.php

http://www.cacti.net/release_notes_1_0_3.php

http://www.cacti.net/release_notes_1_0_4.php

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
104518	GLSA-201711-10 : Cacti: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
99530	Amazon Linux AMI : cacti (ALAS-2017-817)	Nessus	Amazon Linux Local Security Checks	high
97708	openSUSE Security Update : cacti (openSUSE-2017-325)	Nessus	SuSE Local Security Checks	high
97619	Fedora 24 : cacti (2017-a513be0939)	Nessus	Fedora Local Security Checks	high
97590	Fedora 25 : cacti (2017-8b0737b093)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2014-4000

high

Tenable Plugins

critical

high

high

high

high