Cacti 1.2.8 has stored XSS in data_sources.php, color_templates_item.php, graphs.php, graph_items.php, lib/api_automation.php, user_admin.php, and user_group_admin.php, as demonstrated by the description parameter in data_sources.php (a raw string from the database that is displayed by $header to trigger the XSS).

The remote Debian 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-2965 advisory.

  - Cacti before 1.1.37 has XSS because it does not properly reject unintended characters, related to use of     the sanitize_uri function in lib/functions.php. (CVE-2018-10060)

  - Cacti before 1.1.37 has XSS because it makes certain htmlspecialchars calls without the ENT_QUOTES flag     (these calls occur when the html_escape function in lib/html.php is not used). (CVE-2018-10061)

  - In clearFilter() in utilities.php in Cacti before 1.2.3, no escaping occurs before printing out the value     of the SNMP community string (SNMP Options) in the View poller cache, leading to XSS. (CVE-2019-11025)

  - In Cacti before 1.2.11, disabling a user account does not immediately invalidate any permissions granted     to that account (e.g., permission to view logs). (CVE-2020-13230)

  - Multiple Cross Site Scripting (XSS) vulneratiblities exist in Cacti 1.2.12 in (1) reports_admin.php, (2)     data_queries.php, (3) data_input.php, (4) graph_templates.php, (5) graphs.php, (6) reports_admin.php, and     (7) data_input.php. (CVE-2020-23226)

  - Cacti 1.2.8 has stored XSS in data_sources.php, color_templates_item.php, graphs.php, graph_items.php,     lib/api_automation.php, user_admin.php, and user_group_admin.php, as demonstrated by the description     parameter in data_sources.php (a raw string from the database that is displayed by $header to trigger the     XSS). (CVE-2020-7106)

  - Cacti 1.1.38 allows authenticated users with User Management permissions to inject arbitrary web script or     HTML in the new_username field during creation of a new user via Copy method at user_admin.php.
    (CVE-2021-23225)

  - Under certain ldap conditions, Cacti authentication can be bypassed with certain credential types.
    (CVE-2022-0730)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for cacti, cacti-spine fixes the following issues :

cacti-spine and cacti were updated to 1.2.12 :

cacti fixes :

  - CVE-2020-7106: Lack of escaping of color items can lead     to XSS exposure (boo#1163749)

  - Fix multiple graphing bugs and web UI issues

  - Fix multiple warnings, PHP Exceptions and errors

  - Content-Security-Policy prevents External Links from     being opened

  - Prevent runtime memory issues by increasing memory limit

  - Improve SNMPv3 handling

cacti-spine fixes :

  - Failed host lookup causes spine to crash

Cacti developer reports :

Lack of escaping of color items can lead to XSS exposure.

This update for cacti, cacti-spine to version 1.2.11 fixes the following issues :

This update is fixing multiple vulnerabilities and adding bug fixes.
For more details consult the changes file.

The Cacti developers reports :

When guest users have access to realtime graphs, remote code could be executed (CVE-2020-8813).

Lack of escaping on some pages can lead to XSS exposure (CVE-2020-7106).

Remote Code Execution due to input validation failure in Performance Boost Debug Log (CVE-2020-7237).

The remote host is affected by the vulnerability described in GLSA-202003-40 (Cacti: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Cacti. Please review       the CVE identifiers referenced below for details.
  Impact :

    Remote attackers could execute arbitrary code or bypass intended access       restrictions.
  Workaround :

    There is no known workaround at this time.

This update for cacti, cacti-spine fixes the following issues :

cacti-spine was updated to version 1.2.9.

Security issues fixed :

  - CVE-2009-4112: Fixed a privilege escalation     (bsc#1122535).

  - CVE-2018-20723: Fixed a cross-site scripting (XSS)     vulnerability (bsc#1122245).

  - CVE-2018-20724: Fixed a cross-site scripting (XSS)     vulnerability (bsc#1122244).

  - CVE-2018-20725: Fixed a privilege escalation that could     occur under certain conditions (bsc#1122535).

  - CVE-2018-20726: Fixed a cross-site scripting (XSS)     vulnerability (bsc#1122242).

  - CVE-2019-16723: Fixed an authentication bypass     vulnerability.

  - CVE-2019-17357: Fixed a SQL injection vulnerability     (bsc#1158990).

  - CVE-2019-17358: Fixed an unsafe deserialization in     sanitize_unserialize_selected_items (bsc#1158992).

  - CVE-2020-7106: Fixed a potential cross-site scripting     (XSS) vulnerability (bsc#1163749).

  - CVE-2020-7237: Fixed a remote code execution that     affected privileged users via shell metacharacters in     the Performance Boost Debug Log field (bsc#1161297).

Non-security issues fixed :

  - Fixed missing packages php-json, php-ctype, and php-gd     in cacti.spec (boo#1101024).

  - Fixed Apache2.4 and Apache2.2 runtime configuration     issue (boo#1101139).

- Update to 1.2.9

  - CVE-2020-7106, CVE-2020-7237

Release notes: https://www.cacti.net/release_notes.php?version=1.2.9

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that there were a number of cross-site scripting vulnerabilities in cacti, a web interface for monitoring systems.

For Debian 8 'Jessie', this issue has been fixed in cacti version 0.8.8b+dfsg-8+deb8u9.

We recommend that you upgrade your cacti packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
159321	Debian DLA-2965-1 : cacti - LTS security update	Nessus	Debian Local Security Checks	critical
136492	openSUSE Security Update : cacti / cacti-spine (openSUSE-2020-654)	Nessus	SuSE Local Security Checks	medium
136386	FreeBSD : cacti -- XSS exposure (cd864f1a-8e5a-11ea-b5b4-641c67a117d8)	Nessus	FreeBSD Local Security Checks	medium
136073	openSUSE Security Update : cacti / cacti-spine (openSUSE-2020-558)	Nessus	SuSE Local Security Checks	high
135111	FreeBSD : cacti -- multiple vulnerabilities (e2b564fc-7462-11ea-af63-38d547003487)	Nessus	FreeBSD Local Security Checks	high
134726	GLSA-202003-40 : Cacti: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
134195	openSUSE Security Update : cacti / cacti-spine (openSUSE-2020-272)	Nessus	SuSE Local Security Checks	high
133779	Fedora 31 : cacti / cacti-spine (2020-90f1c8229e)	Nessus	Fedora Local Security Checks	high
133775	Fedora 30 : cacti / cacti-spine (2020-0fc6dd0fd2)	Nessus	Fedora Local Security Checks	high
133102	Debian DLA-2069-1 : cacti security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2020-7106

medium

Tenable Plugins

critical

medium

medium

high

high

high

high

high

high

medium