The Cacti developers reports :

When guest users have access to realtime graphs, remote code could be executed (CVE-2020-8813).

Lack of escaping on some pages can lead to XSS exposure (CVE-2020-7106).

Remote Code Execution due to input validation failure in Performance Boost Debug Log (CVE-2020-7237).

The remote host is affected by the vulnerability described in GLSA-202003-40 (Cacti: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Cacti. Please review       the CVE identifiers referenced below for details.
  Impact :

    Remote attackers could execute arbitrary code or bypass intended access       restrictions.
  Workaround :

    There is no known workaround at this time.

This update for cacti, cacti-spine to version 1.2.11 fixes the following issues :

This update is fixing multiple vulnerabilities and adding bug fixes.
For more details consult the changes file.

- Update to 1.2.9

  - CVE-2020-7106, CVE-2020-7237

Release notes: https://www.cacti.net/release_notes.php?version=1.2.9

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for cacti, cacti-spine fixes the following issues :

cacti-spine was updated to version 1.2.9.

Security issues fixed :

  - CVE-2009-4112: Fixed a privilege escalation     (bsc#1122535).

  - CVE-2018-20723: Fixed a cross-site scripting (XSS)     vulnerability (bsc#1122245).

  - CVE-2018-20724: Fixed a cross-site scripting (XSS)     vulnerability (bsc#1122244).

  - CVE-2018-20725: Fixed a privilege escalation that could     occur under certain conditions (bsc#1122535).

  - CVE-2018-20726: Fixed a cross-site scripting (XSS)     vulnerability (bsc#1122242).

  - CVE-2019-16723: Fixed an authentication bypass     vulnerability.

  - CVE-2019-17357: Fixed a SQL injection vulnerability     (bsc#1158990).

  - CVE-2019-17358: Fixed an unsafe deserialization in     sanitize_unserialize_selected_items (bsc#1158992).

  - CVE-2020-7106: Fixed a potential cross-site scripting     (XSS) vulnerability (bsc#1163749).

  - CVE-2020-7237: Fixed a remote code execution that     affected privileged users via shell metacharacters in     the Performance Boost Debug Log field (bsc#1161297).

Non-security issues fixed :

  - Fixed missing packages php-json, php-ctype, and php-gd     in cacti.spec (boo#1101024).

  - Fixed Apache2.4 and Apache2.2 runtime configuration     issue (boo#1101139).

ID	Name	Product	Family	Published	Updated	Severity
135111	FreeBSD : cacti -- multiple vulnerabilities (e2b564fc-7462-11ea-af63-38d547003487)	Nessus	FreeBSD Local Security Checks	4/2/2020	3/20/2024	high
134726	GLSA-202003-40 : Cacti: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	3/20/2020	3/21/2024	high
136073	openSUSE Security Update : cacti / cacti-spine (openSUSE-2020-558)	Nessus	SuSE Local Security Checks	4/29/2020	3/14/2024	high
133775	Fedora 30 : cacti / cacti-spine (2020-0fc6dd0fd2)	Nessus	Fedora Local Security Checks	2/19/2020	3/27/2024	high
133779	Fedora 31 : cacti / cacti-spine (2020-90f1c8229e)	Nessus	Fedora Local Security Checks	2/19/2020	3/27/2024	high
134195	openSUSE Security Update : cacti / cacti-spine (openSUSE-2020-272)	Nessus	SuSE Local Security Checks	3/2/2020	3/25/2024	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high