Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2020-14295 (GCVE-0-2020-14295)
Vulnerability from cvelistv5
Published
2020-06-17 13:47
Modified
2024-08-04 12:39
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
A SQL injection issue in color.php in Cacti 1.2.12 allows an admin to inject SQL via the filter parameter. This can lead to remote command execution because the product accepts stacked queries.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T12:39:36.215Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/Cacti/cacti/issues/3622"
},
{
"name": "FEDORA-2020-8a15713da2",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZKM5G3YNSZDHDZMPCMAHG5B5M2V4XYSE/"
},
{
"name": "FEDORA-2020-7dddce530c",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W64CIB6L4HZRVQSWKPDDKXJO4J2XTOXD/"
},
{
"name": "openSUSE-SU-2020:1060",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00067.html"
},
{
"name": "GLSA-202007-03",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/202007-03"
},
{
"name": "openSUSE-SU-2020:1106",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00085.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/162384/Cacti-1.2.12-SQL-Injection-Remote-Code-Execution.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/162918/Cacti-1.2.12-SQL-Injection-Remote-Command-Execution.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A SQL injection issue in color.php in Cacti 1.2.12 allows an admin to inject SQL via the filter parameter. This can lead to remote command execution because the product accepts stacked queries."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-06-02T15:06:12",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Cacti/cacti/issues/3622"
},
{
"name": "FEDORA-2020-8a15713da2",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZKM5G3YNSZDHDZMPCMAHG5B5M2V4XYSE/"
},
{
"name": "FEDORA-2020-7dddce530c",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W64CIB6L4HZRVQSWKPDDKXJO4J2XTOXD/"
},
{
"name": "openSUSE-SU-2020:1060",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00067.html"
},
{
"name": "GLSA-202007-03",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/202007-03"
},
{
"name": "openSUSE-SU-2020:1106",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00085.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.com/files/162384/Cacti-1.2.12-SQL-Injection-Remote-Code-Execution.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.com/files/162918/Cacti-1.2.12-SQL-Injection-Remote-Command-Execution.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2020-14295",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A SQL injection issue in color.php in Cacti 1.2.12 allows an admin to inject SQL via the filter parameter. This can lead to remote command execution because the product accepts stacked queries."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/Cacti/cacti/issues/3622",
"refsource": "MISC",
"url": "https://github.com/Cacti/cacti/issues/3622"
},
{
"name": "FEDORA-2020-8a15713da2",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZKM5G3YNSZDHDZMPCMAHG5B5M2V4XYSE/"
},
{
"name": "FEDORA-2020-7dddce530c",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W64CIB6L4HZRVQSWKPDDKXJO4J2XTOXD/"
},
{
"name": "openSUSE-SU-2020:1060",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00067.html"
},
{
"name": "GLSA-202007-03",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/202007-03"
},
{
"name": "openSUSE-SU-2020:1106",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00085.html"
},
{
"name": "http://packetstormsecurity.com/files/162384/Cacti-1.2.12-SQL-Injection-Remote-Code-Execution.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/162384/Cacti-1.2.12-SQL-Injection-Remote-Code-Execution.html"
},
{
"name": "http://packetstormsecurity.com/files/162918/Cacti-1.2.12-SQL-Injection-Remote-Command-Execution.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/162918/Cacti-1.2.12-SQL-Injection-Remote-Command-Execution.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2020-14295",
"datePublished": "2020-06-17T13:47:36",
"dateReserved": "2020-06-17T00:00:00",
"dateUpdated": "2024-08-04T12:39:36.215Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2020-14295\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2020-06-17T14:15:10.617\",\"lastModified\":\"2024-11-21T05:02:56.827\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A SQL injection issue in color.php in Cacti 1.2.12 allows an admin to inject SQL via the filter parameter. This can lead to remote command execution because the product accepts stacked queries.\"},{\"lang\":\"es\",\"value\":\"Un problema de inyecci\u00f3n SQL en el archivo color.php en Cacti versi\u00f3n 1.2.12, permite a un administrador inyectar SQL por medio del par\u00e1metro filter. Esto puede conllevar a una ejecuci\u00f3n de comandos remota porque el producto acepta consultas en pila\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.2,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.2,\"impactScore\":5.9}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:S/C:P/I:P/A:P\",\"baseScore\":6.5,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"SINGLE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.0,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-89\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cacti:cacti:1.2.12:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"697145F3-CB18-45CF-9671-148B10B2F3F5\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"80F0FA5D-8D3B-4C0E-81E2-87998286AF33\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"36D96259-24BD-44E2-96D9-78CE1D41F956\"}]}]}],\"references\":[{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00067.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Broken Link\"]},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00085.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Broken Link\"]},{\"url\":\"http://packetstormsecurity.com/files/162384/Cacti-1.2.12-SQL-Injection-Remote-Code-Execution.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Exploit\",\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://packetstormsecurity.com/files/162918/Cacti-1.2.12-SQL-Injection-Remote-Command-Execution.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Exploit\",\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://github.com/Cacti/cacti/issues/3622\",\"source\":\"cve@mitre.org\",\"tags\":[\"Exploit\",\"Issue Tracking\",\"Third Party Advisory\"]},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W64CIB6L4HZRVQSWKPDDKXJO4J2XTOXD/\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZKM5G3YNSZDHDZMPCMAHG5B5M2V4XYSE/\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://security.gentoo.org/glsa/202007-03\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00067.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Broken Link\"]},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00085.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Broken Link\"]},{\"url\":\"http://packetstormsecurity.com/files/162384/Cacti-1.2.12-SQL-Injection-Remote-Code-Execution.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://packetstormsecurity.com/files/162918/Cacti-1.2.12-SQL-Injection-Remote-Command-Execution.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://github.com/Cacti/cacti/issues/3622\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Issue Tracking\",\"Third Party Advisory\"]},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W64CIB6L4HZRVQSWKPDDKXJO4J2XTOXD/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZKM5G3YNSZDHDZMPCMAHG5B5M2V4XYSE/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://security.gentoo.org/glsa/202007-03\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]}]}}"
}
}
opensuse-su-2024:10670-1
Vulnerability from csaf_opensuse
Published
2024-06-15 00:00
Modified
2024-06-15 00:00
Summary
cacti-1.2.18-1.2 on GA media
Notes
Title of the patch
cacti-1.2.18-1.2 on GA media
Description of the patch
These are all security issues fixed in the cacti-1.2.18-1.2 package on the GA media of openSUSE Tumbleweed.
Patchnames
openSUSE-Tumbleweed-2024-10670
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "cacti-1.2.18-1.2 on GA media",
"title": "Title of the patch"
},
{
"category": "description",
"text": "These are all security issues fixed in the cacti-1.2.18-1.2 package on the GA media of openSUSE Tumbleweed.",
"title": "Description of the patch"
},
{
"category": "details",
"text": "openSUSE-Tumbleweed-2024-10670",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2024_10670-1.json"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2006-6799 page",
"url": "https://www.suse.com/security/cve/CVE-2006-6799/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2007-3112 page",
"url": "https://www.suse.com/security/cve/CVE-2007-3112/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2009-4112 page",
"url": "https://www.suse.com/security/cve/CVE-2009-4112/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2014-4000 page",
"url": "https://www.suse.com/security/cve/CVE-2014-4000/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-10970 page",
"url": "https://www.suse.com/security/cve/CVE-2017-10970/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-11163 page",
"url": "https://www.suse.com/security/cve/CVE-2017-11163/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-11691 page",
"url": "https://www.suse.com/security/cve/CVE-2017-11691/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-12065 page",
"url": "https://www.suse.com/security/cve/CVE-2017-12065/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-12927 page",
"url": "https://www.suse.com/security/cve/CVE-2017-12927/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-12978 page",
"url": "https://www.suse.com/security/cve/CVE-2017-12978/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-15194 page",
"url": "https://www.suse.com/security/cve/CVE-2017-15194/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-16641 page",
"url": "https://www.suse.com/security/cve/CVE-2017-16641/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-16660 page",
"url": "https://www.suse.com/security/cve/CVE-2017-16660/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-16661 page",
"url": "https://www.suse.com/security/cve/CVE-2017-16661/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-16785 page",
"url": "https://www.suse.com/security/cve/CVE-2017-16785/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-20723 page",
"url": "https://www.suse.com/security/cve/CVE-2018-20723/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-20724 page",
"url": "https://www.suse.com/security/cve/CVE-2018-20724/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-20725 page",
"url": "https://www.suse.com/security/cve/CVE-2018-20725/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-20726 page",
"url": "https://www.suse.com/security/cve/CVE-2018-20726/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2019-16723 page",
"url": "https://www.suse.com/security/cve/CVE-2019-16723/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2019-17357 page",
"url": "https://www.suse.com/security/cve/CVE-2019-17357/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2019-17358 page",
"url": "https://www.suse.com/security/cve/CVE-2019-17358/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-11022 page",
"url": "https://www.suse.com/security/cve/CVE-2020-11022/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-13625 page",
"url": "https://www.suse.com/security/cve/CVE-2020-13625/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-14295 page",
"url": "https://www.suse.com/security/cve/CVE-2020-14295/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-14424 page",
"url": "https://www.suse.com/security/cve/CVE-2020-14424/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-25706 page",
"url": "https://www.suse.com/security/cve/CVE-2020-25706/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-35701 page",
"url": "https://www.suse.com/security/cve/CVE-2020-35701/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-7106 page",
"url": "https://www.suse.com/security/cve/CVE-2020-7106/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-7237 page",
"url": "https://www.suse.com/security/cve/CVE-2020-7237/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-8813 page",
"url": "https://www.suse.com/security/cve/CVE-2020-8813/"
}
],
"title": "cacti-1.2.18-1.2 on GA media",
"tracking": {
"current_release_date": "2024-06-15T00:00:00Z",
"generator": {
"date": "2024-06-15T00:00:00Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "openSUSE-SU-2024:10670-1",
"initial_release_date": "2024-06-15T00:00:00Z",
"revision_history": [
{
"date": "2024-06-15T00:00:00Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "cacti-1.2.18-1.2.aarch64",
"product": {
"name": "cacti-1.2.18-1.2.aarch64",
"product_id": "cacti-1.2.18-1.2.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "cacti-1.2.18-1.2.ppc64le",
"product": {
"name": "cacti-1.2.18-1.2.ppc64le",
"product_id": "cacti-1.2.18-1.2.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "cacti-1.2.18-1.2.s390x",
"product": {
"name": "cacti-1.2.18-1.2.s390x",
"product_id": "cacti-1.2.18-1.2.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "cacti-1.2.18-1.2.x86_64",
"product": {
"name": "cacti-1.2.18-1.2.x86_64",
"product_id": "cacti-1.2.18-1.2.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "openSUSE Tumbleweed",
"product": {
"name": "openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed",
"product_identification_helper": {
"cpe": "cpe:/o:opensuse:tumbleweed"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "cacti-1.2.18-1.2.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64"
},
"product_reference": "cacti-1.2.18-1.2.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cacti-1.2.18-1.2.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le"
},
"product_reference": "cacti-1.2.18-1.2.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cacti-1.2.18-1.2.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x"
},
"product_reference": "cacti-1.2.18-1.2.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cacti-1.2.18-1.2.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
},
"product_reference": "cacti-1.2.18-1.2.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2006-6799",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2006-6799"
}
],
"notes": [
{
"category": "general",
"text": "SQL injection vulnerability in Cacti 0.8.6i and earlier, when register_argc_argv is enabled, allows remote attackers to execute arbitrary SQL commands via the (1) second or (2) third arguments to cmd.php. NOTE: this issue can be leveraged to execute arbitrary commands since the SQL query results are later used in the polling_items array and popen function.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2006-6799",
"url": "https://www.suse.com/security/cve/CVE-2006-6799"
},
{
"category": "external",
"summary": "SUSE Bug 231082 for CVE-2006-6799",
"url": "https://bugzilla.suse.com/231082"
},
{
"category": "external",
"summary": "SUSE Bug 236724 for CVE-2006-6799",
"url": "https://bugzilla.suse.com/236724"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2006-6799"
},
{
"cve": "CVE-2007-3112",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2007-3112"
}
],
"notes": [
{
"category": "general",
"text": "graph_image.php in Cacti 0.8.6i, and possibly other versions, allows remote authenticated users to cause a denial of service (CPU consumption) via a large value of the (1) graph_start or (2) graph_end parameter, different vectors than CVE-2007-3113.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2007-3112",
"url": "https://www.suse.com/security/cve/CVE-2007-3112"
},
{
"category": "external",
"summary": "SUSE Bug 326228 for CVE-2007-3112",
"url": "https://bugzilla.suse.com/326228"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2007-3112"
},
{
"cve": "CVE-2009-4112",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2009-4112"
}
],
"notes": [
{
"category": "general",
"text": "Cacti 0.8.7e and earlier allows remote authenticated administrators to gain privileges by modifying the \"Data Input Method\" for the \"Linux - Get Memory Usage\" setting to contain arbitrary commands.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2009-4112",
"url": "https://www.suse.com/security/cve/CVE-2009-4112"
},
{
"category": "external",
"summary": "SUSE Bug 1122535 for CVE-2009-4112",
"url": "https://bugzilla.suse.com/1122535"
},
{
"category": "external",
"summary": "SUSE Bug 558664 for CVE-2009-4112",
"url": "https://bugzilla.suse.com/558664"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2009-4112"
},
{
"cve": "CVE-2014-4000",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2014-4000"
}
],
"notes": [
{
"category": "general",
"text": "Cacti before 1.0.0 allows remote authenticated users to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted serialized object, related to calling unserialize(stripslashes()).",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2014-4000",
"url": "https://www.suse.com/security/cve/CVE-2014-4000"
},
{
"category": "external",
"summary": "SUSE Bug 1022564 for CVE-2014-4000",
"url": "https://bugzilla.suse.com/1022564"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2014-4000"
},
{
"cve": "CVE-2017-10970",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-10970"
}
],
"notes": [
{
"category": "general",
"text": "Cross-site scripting (XSS) vulnerability in link.php in Cacti 1.1.12 allows remote anonymous users to inject arbitrary web script or HTML via the id parameter, related to the die_html_input_error function in lib/html_validate.php.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-10970",
"url": "https://www.suse.com/security/cve/CVE-2017-10970"
},
{
"category": "external",
"summary": "SUSE Bug 1047512 for CVE-2017-10970",
"url": "https://bugzilla.suse.com/1047512"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2017-10970"
},
{
"cve": "CVE-2017-11163",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-11163"
}
],
"notes": [
{
"category": "general",
"text": "Cross-site scripting (XSS) vulnerability in aggregate_graphs.php in Cacti 1.1.12 allows remote authenticated users to inject arbitrary web script or HTML via specially crafted HTTP Referer headers, related to the $cancel_url variable.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-11163",
"url": "https://www.suse.com/security/cve/CVE-2017-11163"
},
{
"category": "external",
"summary": "SUSE Bug 1048102 for CVE-2017-11163",
"url": "https://bugzilla.suse.com/1048102"
},
{
"category": "external",
"summary": "SUSE Bug 1051633 for CVE-2017-11163",
"url": "https://bugzilla.suse.com/1051633"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2017-11163"
},
{
"cve": "CVE-2017-11691",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-11691"
}
],
"notes": [
{
"category": "general",
"text": "Cross-site scripting (XSS) vulnerability in auth_profile.php in Cacti 1.1.13 allows remote attackers to inject arbitrary web script or HTML via specially crafted HTTP Referer headers.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-11691",
"url": "https://www.suse.com/security/cve/CVE-2017-11691"
},
{
"category": "external",
"summary": "SUSE Bug 1050950 for CVE-2017-11691",
"url": "https://bugzilla.suse.com/1050950"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2017-11691"
},
{
"cve": "CVE-2017-12065",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-12065"
}
],
"notes": [
{
"category": "general",
"text": "spikekill.php in Cacti before 1.1.16 might allow remote attackers to execute arbitrary code via the avgnan, outlier-start, or outlier-end parameter.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-12065",
"url": "https://www.suse.com/security/cve/CVE-2017-12065"
},
{
"category": "external",
"summary": "SUSE Bug 1051633 for CVE-2017-12065",
"url": "https://bugzilla.suse.com/1051633"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "critical"
}
],
"title": "CVE-2017-12065"
},
{
"cve": "CVE-2017-12927",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-12927"
}
],
"notes": [
{
"category": "general",
"text": "A cross-site scripting vulnerability exists in Cacti 1.1.17 in the method parameter in spikekill.php.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-12927",
"url": "https://www.suse.com/security/cve/CVE-2017-12927"
},
{
"category": "external",
"summary": "SUSE Bug 1054390 for CVE-2017-12927",
"url": "https://bugzilla.suse.com/1054390"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "critical"
}
],
"title": "CVE-2017-12927"
},
{
"cve": "CVE-2017-12978",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-12978"
}
],
"notes": [
{
"category": "general",
"text": "lib/html.php in Cacti before 1.1.18 has XSS via the title field of an external link added by an authenticated user.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-12978",
"url": "https://www.suse.com/security/cve/CVE-2017-12978"
},
{
"category": "external",
"summary": "SUSE Bug 1054742 for CVE-2017-12978",
"url": "https://bugzilla.suse.com/1054742"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2017-12978"
},
{
"cve": "CVE-2017-15194",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-15194"
}
],
"notes": [
{
"category": "general",
"text": "include/global_session.php in Cacti 1.1.25 has XSS related to (1) the URI or (2) the refresh page.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-15194",
"url": "https://www.suse.com/security/cve/CVE-2017-15194"
},
{
"category": "external",
"summary": "SUSE Bug 1062554 for CVE-2017-15194",
"url": "https://bugzilla.suse.com/1062554"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2017-15194"
},
{
"cve": "CVE-2017-16641",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-16641"
}
],
"notes": [
{
"category": "general",
"text": "lib/rrd.php in Cacti 1.1.27 allows remote authenticated administrators to execute arbitrary OS commands via the path_rrdtool parameter in an action=save request to settings.php.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-16641",
"url": "https://www.suse.com/security/cve/CVE-2017-16641"
},
{
"category": "external",
"summary": "SUSE Bug 1067166 for CVE-2017-16641",
"url": "https://bugzilla.suse.com/1067166"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2017-16641"
},
{
"cve": "CVE-2017-16660",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-16660"
}
],
"notes": [
{
"category": "general",
"text": "Cacti 1.1.27 allows remote authenticated administrators to conduct Remote Code Execution attacks by placing the Log Path under the web root, and then making a remote_agent.php request containing PHP code in a Client-ip header.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-16660",
"url": "https://www.suse.com/security/cve/CVE-2017-16660"
},
{
"category": "external",
"summary": "SUSE Bug 1067164 for CVE-2017-16660",
"url": "https://bugzilla.suse.com/1067164"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2017-16660"
},
{
"cve": "CVE-2017-16661",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-16661"
}
],
"notes": [
{
"category": "general",
"text": "Cacti 1.1.27 allows remote authenticated administrators to read arbitrary files by placing the Log Path into a private directory, and then making a clog.php?filename= request, as demonstrated by filename=passwd (with a Log Path under /etc) to read /etc/passwd.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-16661",
"url": "https://www.suse.com/security/cve/CVE-2017-16661"
},
{
"category": "external",
"summary": "SUSE Bug 1067163 for CVE-2017-16661",
"url": "https://bugzilla.suse.com/1067163"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2017-16661"
},
{
"cve": "CVE-2017-16785",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-16785"
}
],
"notes": [
{
"category": "general",
"text": "Cacti 1.1.27 has reflected XSS via the PATH_INFO to host.php.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-16785",
"url": "https://www.suse.com/security/cve/CVE-2017-16785"
},
{
"category": "external",
"summary": "SUSE Bug 1068028 for CVE-2017-16785",
"url": "https://bugzilla.suse.com/1068028"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2017-16785"
},
{
"cve": "CVE-2018-20723",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-20723"
}
],
"notes": [
{
"category": "general",
"text": "A cross-site scripting (XSS) vulnerability exists in color_templates.php in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Name field for a Color.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-20723",
"url": "https://www.suse.com/security/cve/CVE-2018-20723"
},
{
"category": "external",
"summary": "SUSE Bug 1122245 for CVE-2018-20723",
"url": "https://bugzilla.suse.com/1122245"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2018-20723"
},
{
"cve": "CVE-2018-20724",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-20724"
}
],
"notes": [
{
"category": "general",
"text": "A cross-site scripting (XSS) vulnerability exists in pollers.php in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Website Hostname for Data Collectors.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-20724",
"url": "https://www.suse.com/security/cve/CVE-2018-20724"
},
{
"category": "external",
"summary": "SUSE Bug 1122244 for CVE-2018-20724",
"url": "https://bugzilla.suse.com/1122244"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2018-20724"
},
{
"cve": "CVE-2018-20725",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-20725"
}
],
"notes": [
{
"category": "general",
"text": "A cross-site scripting (XSS) vulnerability exists in graph_templates.php in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Graph Vertical Label.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-20725",
"url": "https://www.suse.com/security/cve/CVE-2018-20725"
},
{
"category": "external",
"summary": "SUSE Bug 1122243 for CVE-2018-20725",
"url": "https://bugzilla.suse.com/1122243"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2018-20725"
},
{
"cve": "CVE-2018-20726",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-20726"
}
],
"notes": [
{
"category": "general",
"text": "A cross-site scripting (XSS) vulnerability exists in host.php (via tree.php) in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Website Hostname field for Devices.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-20726",
"url": "https://www.suse.com/security/cve/CVE-2018-20726"
},
{
"category": "external",
"summary": "SUSE Bug 1122242 for CVE-2018-20726",
"url": "https://bugzilla.suse.com/1122242"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2018-20726"
},
{
"cve": "CVE-2019-16723",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2019-16723"
}
],
"notes": [
{
"category": "general",
"text": "In Cacti through 1.2.6, authenticated users may bypass authorization checks (for viewing a graph) via a direct graph_json.php request with a modified local_graph_id parameter.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2019-16723",
"url": "https://www.suse.com/security/cve/CVE-2019-16723"
},
{
"category": "external",
"summary": "SUSE Bug 1151788 for CVE-2019-16723",
"url": "https://bugzilla.suse.com/1151788"
},
{
"category": "external",
"summary": "SUSE Bug 1214170 for CVE-2019-16723",
"url": "https://bugzilla.suse.com/1214170"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2019-16723"
},
{
"cve": "CVE-2019-17357",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2019-17357"
}
],
"notes": [
{
"category": "general",
"text": "Cacti through 1.2.7 is affected by a graphs.php?template_id= SQL injection vulnerability affecting how template identifiers are handled when a string and id composite value are used to identify the template type and id. An authenticated attacker can exploit this to extract data from the database, or an unauthenticated remote attacker could exploit this via Cross-Site Request Forgery.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2019-17357",
"url": "https://www.suse.com/security/cve/CVE-2019-17357"
},
{
"category": "external",
"summary": "SUSE Bug 1158990 for CVE-2019-17357",
"url": "https://bugzilla.suse.com/1158990"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2019-17357"
},
{
"cve": "CVE-2019-17358",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2019-17358"
}
],
"notes": [
{
"category": "general",
"text": "Cacti through 1.2.7 is affected by multiple instances of lib/functions.php unsafe deserialization of user-controlled data to populate arrays. An authenticated attacker could use this to influence object data values and control actions taken by Cacti or potentially cause memory corruption in the PHP module.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2019-17358",
"url": "https://www.suse.com/security/cve/CVE-2019-17358"
},
{
"category": "external",
"summary": "SUSE Bug 1158992 for CVE-2019-17358",
"url": "https://bugzilla.suse.com/1158992"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2019-17358"
},
{
"cve": "CVE-2020-11022",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-11022"
}
],
"notes": [
{
"category": "general",
"text": "In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery\u0027s DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-11022",
"url": "https://www.suse.com/security/cve/CVE-2020-11022"
},
{
"category": "external",
"summary": "SUSE Bug 1173090 for CVE-2020-11022",
"url": "https://bugzilla.suse.com/1173090"
},
{
"category": "external",
"summary": "SUSE Bug 1178434 for CVE-2020-11022",
"url": "https://bugzilla.suse.com/1178434"
},
{
"category": "external",
"summary": "SUSE Bug 1190663 for CVE-2020-11022",
"url": "https://bugzilla.suse.com/1190663"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2020-11022"
},
{
"cve": "CVE-2020-13625",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-13625"
}
],
"notes": [
{
"category": "general",
"text": "PHPMailer before 6.1.6 contains an output escaping bug when the name of a file attachment contains a double quote character. This can result in the file type being misinterpreted by the receiver or any mail relay processing the message.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-13625",
"url": "https://www.suse.com/security/cve/CVE-2020-13625"
},
{
"category": "external",
"summary": "SUSE Bug 1173090 for CVE-2020-13625",
"url": "https://bugzilla.suse.com/1173090"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2020-13625"
},
{
"cve": "CVE-2020-14295",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-14295"
}
],
"notes": [
{
"category": "general",
"text": "A SQL injection issue in color.php in Cacti 1.2.12 allows an admin to inject SQL via the filter parameter. This can lead to remote command execution because the product accepts stacked queries.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-14295",
"url": "https://www.suse.com/security/cve/CVE-2020-14295"
},
{
"category": "external",
"summary": "SUSE Bug 1173090 for CVE-2020-14295",
"url": "https://bugzilla.suse.com/1173090"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2020-14295"
},
{
"cve": "CVE-2020-14424",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-14424"
}
],
"notes": [
{
"category": "general",
"text": "Cacti before 1.2.18 allows remote attackers to trigger XSS via template import for the midwinter theme.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-14424",
"url": "https://www.suse.com/security/cve/CVE-2020-14424"
},
{
"category": "external",
"summary": "SUSE Bug 1188188 for CVE-2020-14424",
"url": "https://bugzilla.suse.com/1188188"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2020-14424"
},
{
"cve": "CVE-2020-25706",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-25706"
}
],
"notes": [
{
"category": "general",
"text": "A cross-site scripting (XSS) vulnerability exists in templates_import.php (Cacti 1.2.13) due to Improper escaping of error message during template import preview in the xml_path field",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-25706",
"url": "https://www.suse.com/security/cve/CVE-2020-25706"
},
{
"category": "external",
"summary": "SUSE Bug 1174850 for CVE-2020-25706",
"url": "https://bugzilla.suse.com/1174850"
},
{
"category": "external",
"summary": "SUSE Bug 1178677 for CVE-2020-25706",
"url": "https://bugzilla.suse.com/1178677"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2020-25706"
},
{
"cve": "CVE-2020-35701",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-35701"
}
],
"notes": [
{
"category": "general",
"text": "An issue was discovered in Cacti 1.2.x through 1.2.16. A SQL injection vulnerability in data_debug.php allows remote authenticated attackers to execute arbitrary SQL commands via the site_id parameter. This can lead to remote code execution.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-35701",
"url": "https://www.suse.com/security/cve/CVE-2020-35701"
},
{
"category": "external",
"summary": "SUSE Bug 1180804 for CVE-2020-35701",
"url": "https://bugzilla.suse.com/1180804"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2020-35701"
},
{
"cve": "CVE-2020-7106",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-7106"
}
],
"notes": [
{
"category": "general",
"text": "Cacti 1.2.8 has stored XSS in data_sources.php, color_templates_item.php, graphs.php, graph_items.php, lib/api_automation.php, user_admin.php, and user_group_admin.php, as demonstrated by the description parameter in data_sources.php (a raw string from the database that is displayed by $header to trigger the XSS).",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-7106",
"url": "https://www.suse.com/security/cve/CVE-2020-7106"
},
{
"category": "external",
"summary": "SUSE Bug 1163749 for CVE-2020-7106",
"url": "https://bugzilla.suse.com/1163749"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2020-7106"
},
{
"cve": "CVE-2020-7237",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-7237"
}
],
"notes": [
{
"category": "general",
"text": "Cacti 1.2.8 allows Remote Code Execution (by privileged users) via shell metacharacters in the Performance Boost Debug Log field of poller_automation.php. OS commands are executed when a new poller cycle begins. The attacker must be authenticated, and must have access to modify the Performance Settings of the product.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-7237",
"url": "https://www.suse.com/security/cve/CVE-2020-7237"
},
{
"category": "external",
"summary": "SUSE Bug 1161297 for CVE-2020-7237",
"url": "https://bugzilla.suse.com/1161297"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2020-7237"
},
{
"cve": "CVE-2020-8813",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-8813"
}
],
"notes": [
{
"category": "general",
"text": "graph_realtime.php in Cacti 1.2.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in a cookie, if a guest user has the graph real-time privilege.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-8813",
"url": "https://www.suse.com/security/cve/CVE-2020-8813"
},
{
"category": "external",
"summary": "SUSE Bug 1154087 for CVE-2020-8813",
"url": "https://bugzilla.suse.com/1154087"
},
{
"category": "external",
"summary": "SUSE Bug 1160867 for CVE-2020-8813",
"url": "https://bugzilla.suse.com/1160867"
},
{
"category": "external",
"summary": "SUSE Bug 1164675 for CVE-2020-8813",
"url": "https://bugzilla.suse.com/1164675"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "critical"
}
],
"title": "CVE-2020-8813"
}
]
}
opensuse-su-2020:1106-1
Vulnerability from csaf_opensuse
Published
2020-07-27 21:28
Modified
2020-07-27 21:28
Summary
Security update for cacti, cacti-spine
Notes
Title of the patch
Security update for cacti, cacti-spine
Description of the patch
This update for cacti, cacti-spine fixes the following issues:
- cacti 1.2.13:
* Query XSS vulnerabilities require vendor package update
(CVE-2020-11022 / CVE-2020-11023)
* Lack of escaping on some pages can lead to XSS exposure
* Update PHPMailer to 6.1.6 (CVE-2020-13625)
* SQL Injection vulnerability due to input validation failure when
editing colors (CVE-2020-14295, boo#1173090)
* Lack of escaping on template import can lead to XSS exposure
- switch from cron to systemd timers (boo#1115436):
+ cacti-cron.timer
+ cacti-cron.service
- avoid potential root escalation on systems with fs.protected_hardlinks=0
(boo#1154087): handle directory permissions in file section instead
of using chown during post installation
- rewrote apache configuration to get rid of .htaccess files and
explicitely disable directory permissions per default
(only allow a limited, well-known set of directories)
This update was imported from the openSUSE:Leap:15.1:Update update project.
Patchnames
openSUSE-2020-1106
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for cacti, cacti-spine",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for cacti, cacti-spine fixes the following issues:\n\n- cacti 1.2.13:\n\n * Query XSS vulnerabilities require vendor package update\n (CVE-2020-11022 / CVE-2020-11023)\n * Lack of escaping on some pages can lead to XSS exposure\n * Update PHPMailer to 6.1.6 (CVE-2020-13625)\n * SQL Injection vulnerability due to input validation failure when\n editing colors (CVE-2020-14295, boo#1173090)\n * Lack of escaping on template import can lead to XSS exposure\n\n- switch from cron to systemd timers (boo#1115436):\n + cacti-cron.timer\n + cacti-cron.service\n- avoid potential root escalation on systems with fs.protected_hardlinks=0\n (boo#1154087): handle directory permissions in file section instead\n of using chown during post installation\n- rewrote apache configuration to get rid of .htaccess files and \n explicitely disable directory permissions per default \n (only allow a limited, well-known set of directories)\n\n\nThis update was imported from the openSUSE:Leap:15.1:Update update project.",
"title": "Description of the patch"
},
{
"category": "details",
"text": "openSUSE-2020-1106",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2020_1106-1.json"
},
{
"category": "self",
"summary": "URL for openSUSE-SU-2020:1106-1",
"url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/4IXKYESUUIOBHBKL32YKWOWHSJKS7RN3/"
},
{
"category": "self",
"summary": "E-Mail link for openSUSE-SU-2020:1106-1",
"url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/4IXKYESUUIOBHBKL32YKWOWHSJKS7RN3/"
},
{
"category": "self",
"summary": "SUSE Bug 1115436",
"url": "https://bugzilla.suse.com/1115436"
},
{
"category": "self",
"summary": "SUSE Bug 1154087",
"url": "https://bugzilla.suse.com/1154087"
},
{
"category": "self",
"summary": "SUSE Bug 1173090",
"url": "https://bugzilla.suse.com/1173090"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-11022 page",
"url": "https://www.suse.com/security/cve/CVE-2020-11022/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-11023 page",
"url": "https://www.suse.com/security/cve/CVE-2020-11023/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-13625 page",
"url": "https://www.suse.com/security/cve/CVE-2020-13625/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-14295 page",
"url": "https://www.suse.com/security/cve/CVE-2020-14295/"
}
],
"title": "Security update for cacti, cacti-spine",
"tracking": {
"current_release_date": "2020-07-27T21:28:47Z",
"generator": {
"date": "2020-07-27T21:28:47Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "openSUSE-SU-2020:1106-1",
"initial_release_date": "2020-07-27T21:28:47Z",
"revision_history": [
{
"date": "2020-07-27T21:28:47Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "cacti-spine-1.2.13-bp151.4.12.1.aarch64",
"product": {
"name": "cacti-spine-1.2.13-bp151.4.12.1.aarch64",
"product_id": "cacti-spine-1.2.13-bp151.4.12.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "cacti-1.2.13-bp151.4.12.1.noarch",
"product": {
"name": "cacti-1.2.13-bp151.4.12.1.noarch",
"product_id": "cacti-1.2.13-bp151.4.12.1.noarch"
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "cacti-spine-1.2.13-bp151.4.12.1.ppc64le",
"product": {
"name": "cacti-spine-1.2.13-bp151.4.12.1.ppc64le",
"product_id": "cacti-spine-1.2.13-bp151.4.12.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "cacti-spine-1.2.13-bp151.4.12.1.s390x",
"product": {
"name": "cacti-spine-1.2.13-bp151.4.12.1.s390x",
"product_id": "cacti-spine-1.2.13-bp151.4.12.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "cacti-spine-1.2.13-bp151.4.12.1.x86_64",
"product": {
"name": "cacti-spine-1.2.13-bp151.4.12.1.x86_64",
"product_id": "cacti-spine-1.2.13-bp151.4.12.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Package Hub 15 SP1",
"product": {
"name": "SUSE Package Hub 15 SP1",
"product_id": "SUSE Package Hub 15 SP1"
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "cacti-1.2.13-bp151.4.12.1.noarch as component of SUSE Package Hub 15 SP1",
"product_id": "SUSE Package Hub 15 SP1:cacti-1.2.13-bp151.4.12.1.noarch"
},
"product_reference": "cacti-1.2.13-bp151.4.12.1.noarch",
"relates_to_product_reference": "SUSE Package Hub 15 SP1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cacti-spine-1.2.13-bp151.4.12.1.aarch64 as component of SUSE Package Hub 15 SP1",
"product_id": "SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.aarch64"
},
"product_reference": "cacti-spine-1.2.13-bp151.4.12.1.aarch64",
"relates_to_product_reference": "SUSE Package Hub 15 SP1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cacti-spine-1.2.13-bp151.4.12.1.ppc64le as component of SUSE Package Hub 15 SP1",
"product_id": "SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.ppc64le"
},
"product_reference": "cacti-spine-1.2.13-bp151.4.12.1.ppc64le",
"relates_to_product_reference": "SUSE Package Hub 15 SP1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cacti-spine-1.2.13-bp151.4.12.1.s390x as component of SUSE Package Hub 15 SP1",
"product_id": "SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.s390x"
},
"product_reference": "cacti-spine-1.2.13-bp151.4.12.1.s390x",
"relates_to_product_reference": "SUSE Package Hub 15 SP1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cacti-spine-1.2.13-bp151.4.12.1.x86_64 as component of SUSE Package Hub 15 SP1",
"product_id": "SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.x86_64"
},
"product_reference": "cacti-spine-1.2.13-bp151.4.12.1.x86_64",
"relates_to_product_reference": "SUSE Package Hub 15 SP1"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2020-11022",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-11022"
}
],
"notes": [
{
"category": "general",
"text": "In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery\u0027s DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Package Hub 15 SP1:cacti-1.2.13-bp151.4.12.1.noarch",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.aarch64",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.ppc64le",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.s390x",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-11022",
"url": "https://www.suse.com/security/cve/CVE-2020-11022"
},
{
"category": "external",
"summary": "SUSE Bug 1173090 for CVE-2020-11022",
"url": "https://bugzilla.suse.com/1173090"
},
{
"category": "external",
"summary": "SUSE Bug 1178434 for CVE-2020-11022",
"url": "https://bugzilla.suse.com/1178434"
},
{
"category": "external",
"summary": "SUSE Bug 1190663 for CVE-2020-11022",
"url": "https://bugzilla.suse.com/1190663"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Package Hub 15 SP1:cacti-1.2.13-bp151.4.12.1.noarch",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.aarch64",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.ppc64le",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.s390x",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Package Hub 15 SP1:cacti-1.2.13-bp151.4.12.1.noarch",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.aarch64",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.ppc64le",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.s390x",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-07-27T21:28:47Z",
"details": "moderate"
}
],
"title": "CVE-2020-11022"
},
{
"cve": "CVE-2020-11023",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-11023"
}
],
"notes": [
{
"category": "general",
"text": "In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing \u003coption\u003e elements from untrusted sources - even after sanitizing it - to one of jQuery\u0027s DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Package Hub 15 SP1:cacti-1.2.13-bp151.4.12.1.noarch",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.aarch64",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.ppc64le",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.s390x",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-11023",
"url": "https://www.suse.com/security/cve/CVE-2020-11023"
},
{
"category": "external",
"summary": "SUSE Bug 1173090 for CVE-2020-11023",
"url": "https://bugzilla.suse.com/1173090"
},
{
"category": "external",
"summary": "SUSE Bug 1178434 for CVE-2020-11023",
"url": "https://bugzilla.suse.com/1178434"
},
{
"category": "external",
"summary": "SUSE Bug 1190660 for CVE-2020-11023",
"url": "https://bugzilla.suse.com/1190660"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Package Hub 15 SP1:cacti-1.2.13-bp151.4.12.1.noarch",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.aarch64",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.ppc64le",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.s390x",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Package Hub 15 SP1:cacti-1.2.13-bp151.4.12.1.noarch",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.aarch64",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.ppc64le",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.s390x",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-07-27T21:28:47Z",
"details": "moderate"
}
],
"title": "CVE-2020-11023"
},
{
"cve": "CVE-2020-13625",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-13625"
}
],
"notes": [
{
"category": "general",
"text": "PHPMailer before 6.1.6 contains an output escaping bug when the name of a file attachment contains a double quote character. This can result in the file type being misinterpreted by the receiver or any mail relay processing the message.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Package Hub 15 SP1:cacti-1.2.13-bp151.4.12.1.noarch",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.aarch64",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.ppc64le",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.s390x",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-13625",
"url": "https://www.suse.com/security/cve/CVE-2020-13625"
},
{
"category": "external",
"summary": "SUSE Bug 1173090 for CVE-2020-13625",
"url": "https://bugzilla.suse.com/1173090"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Package Hub 15 SP1:cacti-1.2.13-bp151.4.12.1.noarch",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.aarch64",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.ppc64le",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.s390x",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Package Hub 15 SP1:cacti-1.2.13-bp151.4.12.1.noarch",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.aarch64",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.ppc64le",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.s390x",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-07-27T21:28:47Z",
"details": "important"
}
],
"title": "CVE-2020-13625"
},
{
"cve": "CVE-2020-14295",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-14295"
}
],
"notes": [
{
"category": "general",
"text": "A SQL injection issue in color.php in Cacti 1.2.12 allows an admin to inject SQL via the filter parameter. This can lead to remote command execution because the product accepts stacked queries.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Package Hub 15 SP1:cacti-1.2.13-bp151.4.12.1.noarch",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.aarch64",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.ppc64le",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.s390x",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-14295",
"url": "https://www.suse.com/security/cve/CVE-2020-14295"
},
{
"category": "external",
"summary": "SUSE Bug 1173090 for CVE-2020-14295",
"url": "https://bugzilla.suse.com/1173090"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Package Hub 15 SP1:cacti-1.2.13-bp151.4.12.1.noarch",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.aarch64",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.ppc64le",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.s390x",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Package Hub 15 SP1:cacti-1.2.13-bp151.4.12.1.noarch",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.aarch64",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.ppc64le",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.s390x",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-07-27T21:28:47Z",
"details": "important"
}
],
"title": "CVE-2020-14295"
}
]
}
opensuse-su-2020:1060-1
Vulnerability from csaf_opensuse
Published
2020-07-25 18:21
Modified
2020-07-25 18:21
Summary
Security update for cacti, cacti-spine
Notes
Title of the patch
Security update for cacti, cacti-spine
Description of the patch
This update for cacti, cacti-spine fixes the following issues:
- cacti 1.2.13:
* Query XSS vulnerabilities require vendor package update
(CVE-2020-11022 / CVE-2020-11023)
* Lack of escaping on some pages can lead to XSS exposure
* Update PHPMailer to 6.1.6 (CVE-2020-13625)
* SQL Injection vulnerability due to input validation failure when
editing colors (CVE-2020-14295, boo#1173090)
* Lack of escaping on template import can lead to XSS exposure
- switch from cron to systemd timers (boo#1115436):
+ cacti-cron.timer
+ cacti-cron.service
- avoid potential root escalation on systems with fs.protected_hardlinks=0
(boo#1154087): handle directory permissions in file section instead
of using chown during post installation
- rewrote apache configuration to get rid of .htaccess files and
explicitely disable directory permissions per default
(only allow a limited, well-known set of directories)
Patchnames
openSUSE-2020-1060
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for cacti, cacti-spine",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for cacti, cacti-spine fixes the following issues:\n\n- cacti 1.2.13:\n\n * Query XSS vulnerabilities require vendor package update\n (CVE-2020-11022 / CVE-2020-11023)\n * Lack of escaping on some pages can lead to XSS exposure\n * Update PHPMailer to 6.1.6 (CVE-2020-13625)\n * SQL Injection vulnerability due to input validation failure when\n editing colors (CVE-2020-14295, boo#1173090)\n * Lack of escaping on template import can lead to XSS exposure\n\n- switch from cron to systemd timers (boo#1115436):\n + cacti-cron.timer\n + cacti-cron.service\n- avoid potential root escalation on systems with fs.protected_hardlinks=0\n (boo#1154087): handle directory permissions in file section instead\n of using chown during post installation\n- rewrote apache configuration to get rid of .htaccess files and \n explicitely disable directory permissions per default \n (only allow a limited, well-known set of directories)\n\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "openSUSE-2020-1060",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2020_1060-1.json"
},
{
"category": "self",
"summary": "URL for openSUSE-SU-2020:1060-1",
"url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/VVPI65AW45TXMRAYCWJ6YJT3LF4GIMWL/"
},
{
"category": "self",
"summary": "E-Mail link for openSUSE-SU-2020:1060-1",
"url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/VVPI65AW45TXMRAYCWJ6YJT3LF4GIMWL/"
},
{
"category": "self",
"summary": "SUSE Bug 1115436",
"url": "https://bugzilla.suse.com/1115436"
},
{
"category": "self",
"summary": "SUSE Bug 1154087",
"url": "https://bugzilla.suse.com/1154087"
},
{
"category": "self",
"summary": "SUSE Bug 1173090",
"url": "https://bugzilla.suse.com/1173090"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-11022 page",
"url": "https://www.suse.com/security/cve/CVE-2020-11022/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-11023 page",
"url": "https://www.suse.com/security/cve/CVE-2020-11023/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-13625 page",
"url": "https://www.suse.com/security/cve/CVE-2020-13625/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-14295 page",
"url": "https://www.suse.com/security/cve/CVE-2020-14295/"
}
],
"title": "Security update for cacti, cacti-spine",
"tracking": {
"current_release_date": "2020-07-25T18:21:21Z",
"generator": {
"date": "2020-07-25T18:21:21Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "openSUSE-SU-2020:1060-1",
"initial_release_date": "2020-07-25T18:21:21Z",
"revision_history": [
{
"date": "2020-07-25T18:21:21Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "cacti-spine-1.2.13-8.1.aarch64",
"product": {
"name": "cacti-spine-1.2.13-8.1.aarch64",
"product_id": "cacti-spine-1.2.13-8.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "cacti-1.2.13-11.1.noarch",
"product": {
"name": "cacti-1.2.13-11.1.noarch",
"product_id": "cacti-1.2.13-11.1.noarch"
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "cacti-spine-1.2.13-8.1.ppc64le",
"product": {
"name": "cacti-spine-1.2.13-8.1.ppc64le",
"product_id": "cacti-spine-1.2.13-8.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "cacti-spine-1.2.13-8.1.s390x",
"product": {
"name": "cacti-spine-1.2.13-8.1.s390x",
"product_id": "cacti-spine-1.2.13-8.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "cacti-spine-1.2.13-8.1.x86_64",
"product": {
"name": "cacti-spine-1.2.13-8.1.x86_64",
"product_id": "cacti-spine-1.2.13-8.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Package Hub 12",
"product": {
"name": "SUSE Package Hub 12",
"product_id": "SUSE Package Hub 12",
"product_identification_helper": {
"cpe": "cpe:/o:suse:packagehub:12"
}
}
},
{
"category": "product_name",
"name": "openSUSE Leap 15.1",
"product": {
"name": "openSUSE Leap 15.1",
"product_id": "openSUSE Leap 15.1",
"product_identification_helper": {
"cpe": "cpe:/o:opensuse:leap:15.1"
}
}
},
{
"category": "product_name",
"name": "openSUSE Leap 15.2",
"product": {
"name": "openSUSE Leap 15.2",
"product_id": "openSUSE Leap 15.2",
"product_identification_helper": {
"cpe": "cpe:/o:opensuse:leap:15.2"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "cacti-1.2.13-11.1.noarch as component of SUSE Package Hub 12",
"product_id": "SUSE Package Hub 12:cacti-1.2.13-11.1.noarch"
},
"product_reference": "cacti-1.2.13-11.1.noarch",
"relates_to_product_reference": "SUSE Package Hub 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cacti-spine-1.2.13-8.1.aarch64 as component of SUSE Package Hub 12",
"product_id": "SUSE Package Hub 12:cacti-spine-1.2.13-8.1.aarch64"
},
"product_reference": "cacti-spine-1.2.13-8.1.aarch64",
"relates_to_product_reference": "SUSE Package Hub 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cacti-spine-1.2.13-8.1.ppc64le as component of SUSE Package Hub 12",
"product_id": "SUSE Package Hub 12:cacti-spine-1.2.13-8.1.ppc64le"
},
"product_reference": "cacti-spine-1.2.13-8.1.ppc64le",
"relates_to_product_reference": "SUSE Package Hub 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cacti-spine-1.2.13-8.1.s390x as component of SUSE Package Hub 12",
"product_id": "SUSE Package Hub 12:cacti-spine-1.2.13-8.1.s390x"
},
"product_reference": "cacti-spine-1.2.13-8.1.s390x",
"relates_to_product_reference": "SUSE Package Hub 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cacti-spine-1.2.13-8.1.x86_64 as component of SUSE Package Hub 12",
"product_id": "SUSE Package Hub 12:cacti-spine-1.2.13-8.1.x86_64"
},
"product_reference": "cacti-spine-1.2.13-8.1.x86_64",
"relates_to_product_reference": "SUSE Package Hub 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cacti-1.2.13-11.1.noarch as component of openSUSE Leap 15.1",
"product_id": "openSUSE Leap 15.1:cacti-1.2.13-11.1.noarch"
},
"product_reference": "cacti-1.2.13-11.1.noarch",
"relates_to_product_reference": "openSUSE Leap 15.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cacti-spine-1.2.13-8.1.aarch64 as component of openSUSE Leap 15.1",
"product_id": "openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.aarch64"
},
"product_reference": "cacti-spine-1.2.13-8.1.aarch64",
"relates_to_product_reference": "openSUSE Leap 15.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cacti-spine-1.2.13-8.1.ppc64le as component of openSUSE Leap 15.1",
"product_id": "openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.ppc64le"
},
"product_reference": "cacti-spine-1.2.13-8.1.ppc64le",
"relates_to_product_reference": "openSUSE Leap 15.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cacti-spine-1.2.13-8.1.s390x as component of openSUSE Leap 15.1",
"product_id": "openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.s390x"
},
"product_reference": "cacti-spine-1.2.13-8.1.s390x",
"relates_to_product_reference": "openSUSE Leap 15.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cacti-spine-1.2.13-8.1.x86_64 as component of openSUSE Leap 15.1",
"product_id": "openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.x86_64"
},
"product_reference": "cacti-spine-1.2.13-8.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cacti-1.2.13-11.1.noarch as component of openSUSE Leap 15.2",
"product_id": "openSUSE Leap 15.2:cacti-1.2.13-11.1.noarch"
},
"product_reference": "cacti-1.2.13-11.1.noarch",
"relates_to_product_reference": "openSUSE Leap 15.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cacti-spine-1.2.13-8.1.aarch64 as component of openSUSE Leap 15.2",
"product_id": "openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.aarch64"
},
"product_reference": "cacti-spine-1.2.13-8.1.aarch64",
"relates_to_product_reference": "openSUSE Leap 15.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cacti-spine-1.2.13-8.1.ppc64le as component of openSUSE Leap 15.2",
"product_id": "openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.ppc64le"
},
"product_reference": "cacti-spine-1.2.13-8.1.ppc64le",
"relates_to_product_reference": "openSUSE Leap 15.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cacti-spine-1.2.13-8.1.s390x as component of openSUSE Leap 15.2",
"product_id": "openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.s390x"
},
"product_reference": "cacti-spine-1.2.13-8.1.s390x",
"relates_to_product_reference": "openSUSE Leap 15.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cacti-spine-1.2.13-8.1.x86_64 as component of openSUSE Leap 15.2",
"product_id": "openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.x86_64"
},
"product_reference": "cacti-spine-1.2.13-8.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.2"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2020-11022",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-11022"
}
],
"notes": [
{
"category": "general",
"text": "In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery\u0027s DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Package Hub 12:cacti-1.2.13-11.1.noarch",
"SUSE Package Hub 12:cacti-spine-1.2.13-8.1.aarch64",
"SUSE Package Hub 12:cacti-spine-1.2.13-8.1.ppc64le",
"SUSE Package Hub 12:cacti-spine-1.2.13-8.1.s390x",
"SUSE Package Hub 12:cacti-spine-1.2.13-8.1.x86_64",
"openSUSE Leap 15.1:cacti-1.2.13-11.1.noarch",
"openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.aarch64",
"openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.ppc64le",
"openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.s390x",
"openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.x86_64",
"openSUSE Leap 15.2:cacti-1.2.13-11.1.noarch",
"openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.aarch64",
"openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.ppc64le",
"openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.s390x",
"openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-11022",
"url": "https://www.suse.com/security/cve/CVE-2020-11022"
},
{
"category": "external",
"summary": "SUSE Bug 1173090 for CVE-2020-11022",
"url": "https://bugzilla.suse.com/1173090"
},
{
"category": "external",
"summary": "SUSE Bug 1178434 for CVE-2020-11022",
"url": "https://bugzilla.suse.com/1178434"
},
{
"category": "external",
"summary": "SUSE Bug 1190663 for CVE-2020-11022",
"url": "https://bugzilla.suse.com/1190663"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Package Hub 12:cacti-1.2.13-11.1.noarch",
"SUSE Package Hub 12:cacti-spine-1.2.13-8.1.aarch64",
"SUSE Package Hub 12:cacti-spine-1.2.13-8.1.ppc64le",
"SUSE Package Hub 12:cacti-spine-1.2.13-8.1.s390x",
"SUSE Package Hub 12:cacti-spine-1.2.13-8.1.x86_64",
"openSUSE Leap 15.1:cacti-1.2.13-11.1.noarch",
"openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.aarch64",
"openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.ppc64le",
"openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.s390x",
"openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.x86_64",
"openSUSE Leap 15.2:cacti-1.2.13-11.1.noarch",
"openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.aarch64",
"openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.ppc64le",
"openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.s390x",
"openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Package Hub 12:cacti-1.2.13-11.1.noarch",
"SUSE Package Hub 12:cacti-spine-1.2.13-8.1.aarch64",
"SUSE Package Hub 12:cacti-spine-1.2.13-8.1.ppc64le",
"SUSE Package Hub 12:cacti-spine-1.2.13-8.1.s390x",
"SUSE Package Hub 12:cacti-spine-1.2.13-8.1.x86_64",
"openSUSE Leap 15.1:cacti-1.2.13-11.1.noarch",
"openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.aarch64",
"openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.ppc64le",
"openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.s390x",
"openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.x86_64",
"openSUSE Leap 15.2:cacti-1.2.13-11.1.noarch",
"openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.aarch64",
"openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.ppc64le",
"openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.s390x",
"openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-07-25T18:21:21Z",
"details": "moderate"
}
],
"title": "CVE-2020-11022"
},
{
"cve": "CVE-2020-11023",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-11023"
}
],
"notes": [
{
"category": "general",
"text": "In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing \u003coption\u003e elements from untrusted sources - even after sanitizing it - to one of jQuery\u0027s DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Package Hub 12:cacti-1.2.13-11.1.noarch",
"SUSE Package Hub 12:cacti-spine-1.2.13-8.1.aarch64",
"SUSE Package Hub 12:cacti-spine-1.2.13-8.1.ppc64le",
"SUSE Package Hub 12:cacti-spine-1.2.13-8.1.s390x",
"SUSE Package Hub 12:cacti-spine-1.2.13-8.1.x86_64",
"openSUSE Leap 15.1:cacti-1.2.13-11.1.noarch",
"openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.aarch64",
"openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.ppc64le",
"openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.s390x",
"openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.x86_64",
"openSUSE Leap 15.2:cacti-1.2.13-11.1.noarch",
"openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.aarch64",
"openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.ppc64le",
"openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.s390x",
"openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-11023",
"url": "https://www.suse.com/security/cve/CVE-2020-11023"
},
{
"category": "external",
"summary": "SUSE Bug 1173090 for CVE-2020-11023",
"url": "https://bugzilla.suse.com/1173090"
},
{
"category": "external",
"summary": "SUSE Bug 1178434 for CVE-2020-11023",
"url": "https://bugzilla.suse.com/1178434"
},
{
"category": "external",
"summary": "SUSE Bug 1190660 for CVE-2020-11023",
"url": "https://bugzilla.suse.com/1190660"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Package Hub 12:cacti-1.2.13-11.1.noarch",
"SUSE Package Hub 12:cacti-spine-1.2.13-8.1.aarch64",
"SUSE Package Hub 12:cacti-spine-1.2.13-8.1.ppc64le",
"SUSE Package Hub 12:cacti-spine-1.2.13-8.1.s390x",
"SUSE Package Hub 12:cacti-spine-1.2.13-8.1.x86_64",
"openSUSE Leap 15.1:cacti-1.2.13-11.1.noarch",
"openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.aarch64",
"openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.ppc64le",
"openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.s390x",
"openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.x86_64",
"openSUSE Leap 15.2:cacti-1.2.13-11.1.noarch",
"openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.aarch64",
"openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.ppc64le",
"openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.s390x",
"openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Package Hub 12:cacti-1.2.13-11.1.noarch",
"SUSE Package Hub 12:cacti-spine-1.2.13-8.1.aarch64",
"SUSE Package Hub 12:cacti-spine-1.2.13-8.1.ppc64le",
"SUSE Package Hub 12:cacti-spine-1.2.13-8.1.s390x",
"SUSE Package Hub 12:cacti-spine-1.2.13-8.1.x86_64",
"openSUSE Leap 15.1:cacti-1.2.13-11.1.noarch",
"openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.aarch64",
"openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.ppc64le",
"openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.s390x",
"openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.x86_64",
"openSUSE Leap 15.2:cacti-1.2.13-11.1.noarch",
"openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.aarch64",
"openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.ppc64le",
"openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.s390x",
"openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-07-25T18:21:21Z",
"details": "moderate"
}
],
"title": "CVE-2020-11023"
},
{
"cve": "CVE-2020-13625",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-13625"
}
],
"notes": [
{
"category": "general",
"text": "PHPMailer before 6.1.6 contains an output escaping bug when the name of a file attachment contains a double quote character. This can result in the file type being misinterpreted by the receiver or any mail relay processing the message.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Package Hub 12:cacti-1.2.13-11.1.noarch",
"SUSE Package Hub 12:cacti-spine-1.2.13-8.1.aarch64",
"SUSE Package Hub 12:cacti-spine-1.2.13-8.1.ppc64le",
"SUSE Package Hub 12:cacti-spine-1.2.13-8.1.s390x",
"SUSE Package Hub 12:cacti-spine-1.2.13-8.1.x86_64",
"openSUSE Leap 15.1:cacti-1.2.13-11.1.noarch",
"openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.aarch64",
"openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.ppc64le",
"openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.s390x",
"openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.x86_64",
"openSUSE Leap 15.2:cacti-1.2.13-11.1.noarch",
"openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.aarch64",
"openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.ppc64le",
"openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.s390x",
"openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-13625",
"url": "https://www.suse.com/security/cve/CVE-2020-13625"
},
{
"category": "external",
"summary": "SUSE Bug 1173090 for CVE-2020-13625",
"url": "https://bugzilla.suse.com/1173090"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Package Hub 12:cacti-1.2.13-11.1.noarch",
"SUSE Package Hub 12:cacti-spine-1.2.13-8.1.aarch64",
"SUSE Package Hub 12:cacti-spine-1.2.13-8.1.ppc64le",
"SUSE Package Hub 12:cacti-spine-1.2.13-8.1.s390x",
"SUSE Package Hub 12:cacti-spine-1.2.13-8.1.x86_64",
"openSUSE Leap 15.1:cacti-1.2.13-11.1.noarch",
"openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.aarch64",
"openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.ppc64le",
"openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.s390x",
"openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.x86_64",
"openSUSE Leap 15.2:cacti-1.2.13-11.1.noarch",
"openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.aarch64",
"openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.ppc64le",
"openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.s390x",
"openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Package Hub 12:cacti-1.2.13-11.1.noarch",
"SUSE Package Hub 12:cacti-spine-1.2.13-8.1.aarch64",
"SUSE Package Hub 12:cacti-spine-1.2.13-8.1.ppc64le",
"SUSE Package Hub 12:cacti-spine-1.2.13-8.1.s390x",
"SUSE Package Hub 12:cacti-spine-1.2.13-8.1.x86_64",
"openSUSE Leap 15.1:cacti-1.2.13-11.1.noarch",
"openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.aarch64",
"openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.ppc64le",
"openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.s390x",
"openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.x86_64",
"openSUSE Leap 15.2:cacti-1.2.13-11.1.noarch",
"openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.aarch64",
"openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.ppc64le",
"openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.s390x",
"openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-07-25T18:21:21Z",
"details": "important"
}
],
"title": "CVE-2020-13625"
},
{
"cve": "CVE-2020-14295",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-14295"
}
],
"notes": [
{
"category": "general",
"text": "A SQL injection issue in color.php in Cacti 1.2.12 allows an admin to inject SQL via the filter parameter. This can lead to remote command execution because the product accepts stacked queries.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Package Hub 12:cacti-1.2.13-11.1.noarch",
"SUSE Package Hub 12:cacti-spine-1.2.13-8.1.aarch64",
"SUSE Package Hub 12:cacti-spine-1.2.13-8.1.ppc64le",
"SUSE Package Hub 12:cacti-spine-1.2.13-8.1.s390x",
"SUSE Package Hub 12:cacti-spine-1.2.13-8.1.x86_64",
"openSUSE Leap 15.1:cacti-1.2.13-11.1.noarch",
"openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.aarch64",
"openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.ppc64le",
"openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.s390x",
"openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.x86_64",
"openSUSE Leap 15.2:cacti-1.2.13-11.1.noarch",
"openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.aarch64",
"openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.ppc64le",
"openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.s390x",
"openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-14295",
"url": "https://www.suse.com/security/cve/CVE-2020-14295"
},
{
"category": "external",
"summary": "SUSE Bug 1173090 for CVE-2020-14295",
"url": "https://bugzilla.suse.com/1173090"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Package Hub 12:cacti-1.2.13-11.1.noarch",
"SUSE Package Hub 12:cacti-spine-1.2.13-8.1.aarch64",
"SUSE Package Hub 12:cacti-spine-1.2.13-8.1.ppc64le",
"SUSE Package Hub 12:cacti-spine-1.2.13-8.1.s390x",
"SUSE Package Hub 12:cacti-spine-1.2.13-8.1.x86_64",
"openSUSE Leap 15.1:cacti-1.2.13-11.1.noarch",
"openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.aarch64",
"openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.ppc64le",
"openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.s390x",
"openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.x86_64",
"openSUSE Leap 15.2:cacti-1.2.13-11.1.noarch",
"openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.aarch64",
"openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.ppc64le",
"openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.s390x",
"openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Package Hub 12:cacti-1.2.13-11.1.noarch",
"SUSE Package Hub 12:cacti-spine-1.2.13-8.1.aarch64",
"SUSE Package Hub 12:cacti-spine-1.2.13-8.1.ppc64le",
"SUSE Package Hub 12:cacti-spine-1.2.13-8.1.s390x",
"SUSE Package Hub 12:cacti-spine-1.2.13-8.1.x86_64",
"openSUSE Leap 15.1:cacti-1.2.13-11.1.noarch",
"openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.aarch64",
"openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.ppc64le",
"openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.s390x",
"openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.x86_64",
"openSUSE Leap 15.2:cacti-1.2.13-11.1.noarch",
"openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.aarch64",
"openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.ppc64le",
"openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.s390x",
"openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-07-25T18:21:21Z",
"details": "important"
}
],
"title": "CVE-2020-14295"
}
]
}
ghsa-rwpv-9gq4-x5g3
Vulnerability from github
Published
2022-05-24 17:20
Modified
2022-11-16 12:00
Severity ?
VLAI Severity ?
Details
A SQL injection issue in color.php in Cacti 1.2.12 allows an admin to inject SQL via the filter parameter. This can lead to remote command execution because the product accepts stacked queries.
{
"affected": [],
"aliases": [
"CVE-2020-14295"
],
"database_specific": {
"cwe_ids": [
"CWE-89"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-06-17T14:15:00Z",
"severity": "MODERATE"
},
"details": "A SQL injection issue in color.php in Cacti 1.2.12 allows an admin to inject SQL via the filter parameter. This can lead to remote command execution because the product accepts stacked queries.",
"id": "GHSA-rwpv-9gq4-x5g3",
"modified": "2022-11-16T12:00:19Z",
"published": "2022-05-24T17:20:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14295"
},
{
"type": "WEB",
"url": "https://github.com/Cacti/cacti/issues/3622"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W64CIB6L4HZRVQSWKPDDKXJO4J2XTOXD"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZKM5G3YNSZDHDZMPCMAHG5B5M2V4XYSE"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/202007-03"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00067.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00085.html"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/162384/Cacti-1.2.12-SQL-Injection-Remote-Code-Execution.html"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/162918/Cacti-1.2.12-SQL-Injection-Remote-Command-Execution.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
gsd-2020-14295
Vulnerability from gsd
Modified
2023-12-13 01:22
Details
A SQL injection issue in color.php in Cacti 1.2.12 allows an admin to inject SQL via the filter parameter. This can lead to remote command execution because the product accepts stacked queries.
Aliases
Aliases
{
"GSD": {
"alias": "CVE-2020-14295",
"description": "A SQL injection issue in color.php in Cacti 1.2.12 allows an admin to inject SQL via the filter parameter. This can lead to remote command execution because the product accepts stacked queries.",
"id": "GSD-2020-14295",
"references": [
"https://www.suse.com/security/cve/CVE-2020-14295.html",
"https://packetstormsecurity.com/files/cve/CVE-2020-14295",
"https://ubuntu.com/security/CVE-2020-14295"
]
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"aliases": [
"CVE-2020-14295"
],
"details": "A SQL injection issue in color.php in Cacti 1.2.12 allows an admin to inject SQL via the filter parameter. This can lead to remote command execution because the product accepts stacked queries.",
"id": "GSD-2020-14295",
"modified": "2023-12-13T01:22:00.364654Z",
"schema_version": "1.4.0"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2020-14295",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A SQL injection issue in color.php in Cacti 1.2.12 allows an admin to inject SQL via the filter parameter. This can lead to remote command execution because the product accepts stacked queries."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/Cacti/cacti/issues/3622",
"refsource": "MISC",
"url": "https://github.com/Cacti/cacti/issues/3622"
},
{
"name": "FEDORA-2020-8a15713da2",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZKM5G3YNSZDHDZMPCMAHG5B5M2V4XYSE/"
},
{
"name": "FEDORA-2020-7dddce530c",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W64CIB6L4HZRVQSWKPDDKXJO4J2XTOXD/"
},
{
"name": "openSUSE-SU-2020:1060",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00067.html"
},
{
"name": "GLSA-202007-03",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/202007-03"
},
{
"name": "openSUSE-SU-2020:1106",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00085.html"
},
{
"name": "http://packetstormsecurity.com/files/162384/Cacti-1.2.12-SQL-Injection-Remote-Code-Execution.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/162384/Cacti-1.2.12-SQL-Injection-Remote-Code-Execution.html"
},
{
"name": "http://packetstormsecurity.com/files/162918/Cacti-1.2.12-SQL-Injection-Remote-Command-Execution.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/162918/Cacti-1.2.12-SQL-Injection-Remote-Command-Execution.html"
}
]
}
},
"nvd.nist.gov": {
"configurations": {
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:cacti:cacti:1.2.12:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
},
"cve": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2020-14295"
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "en",
"value": "A SQL injection issue in color.php in Cacti 1.2.12 allows an admin to inject SQL via the filter parameter. This can lead to remote command execution because the product accepts stacked queries."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "en",
"value": "CWE-89"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/Cacti/cacti/issues/3622",
"refsource": "MISC",
"tags": [
"Exploit",
"Issue Tracking",
"Third Party Advisory"
],
"url": "https://github.com/Cacti/cacti/issues/3622"
},
{
"name": "FEDORA-2020-7dddce530c",
"refsource": "FEDORA",
"tags": [
"Third Party Advisory"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W64CIB6L4HZRVQSWKPDDKXJO4J2XTOXD/"
},
{
"name": "FEDORA-2020-8a15713da2",
"refsource": "FEDORA",
"tags": [
"Third Party Advisory"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZKM5G3YNSZDHDZMPCMAHG5B5M2V4XYSE/"
},
{
"name": "openSUSE-SU-2020:1060",
"refsource": "SUSE",
"tags": [
"Broken Link"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00067.html"
},
{
"name": "GLSA-202007-03",
"refsource": "GENTOO",
"tags": [
"Third Party Advisory"
],
"url": "https://security.gentoo.org/glsa/202007-03"
},
{
"name": "openSUSE-SU-2020:1106",
"refsource": "SUSE",
"tags": [
"Broken Link"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00085.html"
},
{
"name": "http://packetstormsecurity.com/files/162384/Cacti-1.2.12-SQL-Injection-Remote-Code-Execution.html",
"refsource": "MISC",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "http://packetstormsecurity.com/files/162384/Cacti-1.2.12-SQL-Injection-Remote-Code-Execution.html"
},
{
"name": "http://packetstormsecurity.com/files/162918/Cacti-1.2.12-SQL-Injection-Remote-Command-Execution.html",
"refsource": "MISC",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "http://packetstormsecurity.com/files/162918/Cacti-1.2.12-SQL-Injection-Remote-Command-Execution.html"
}
]
}
},
"impact": {
"baseMetricV2": {
"acInsufInfo": false,
"cvssV2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"userInteractionRequired": false
},
"baseMetricV3": {
"cvssV3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.2,
"impactScore": 5.9
}
},
"lastModifiedDate": "2022-11-16T03:50Z",
"publishedDate": "2020-06-17T14:15Z"
}
}
}
fkie_cve-2020-14295
Vulnerability from fkie_nvd
Published
2020-06-17 14:15
Modified
2024-11-21 05:02
Severity ?
Summary
A SQL injection issue in color.php in Cacti 1.2.12 allows an admin to inject SQL via the filter parameter. This can lead to remote command execution because the product accepts stacked queries.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00067.html | Broken Link | |
| cve@mitre.org | http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00085.html | Broken Link | |
| cve@mitre.org | http://packetstormsecurity.com/files/162384/Cacti-1.2.12-SQL-Injection-Remote-Code-Execution.html | Exploit, Third Party Advisory, VDB Entry | |
| cve@mitre.org | http://packetstormsecurity.com/files/162918/Cacti-1.2.12-SQL-Injection-Remote-Command-Execution.html | Exploit, Third Party Advisory, VDB Entry | |
| cve@mitre.org | https://github.com/Cacti/cacti/issues/3622 | Exploit, Issue Tracking, Third Party Advisory | |
| cve@mitre.org | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W64CIB6L4HZRVQSWKPDDKXJO4J2XTOXD/ | ||
| cve@mitre.org | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZKM5G3YNSZDHDZMPCMAHG5B5M2V4XYSE/ | ||
| cve@mitre.org | https://security.gentoo.org/glsa/202007-03 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00067.html | Broken Link | |
| af854a3a-2127-422b-91ae-364da2661108 | http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00085.html | Broken Link | |
| af854a3a-2127-422b-91ae-364da2661108 | http://packetstormsecurity.com/files/162384/Cacti-1.2.12-SQL-Injection-Remote-Code-Execution.html | Exploit, Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | http://packetstormsecurity.com/files/162918/Cacti-1.2.12-SQL-Injection-Remote-Command-Execution.html | Exploit, Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/Cacti/cacti/issues/3622 | Exploit, Issue Tracking, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W64CIB6L4HZRVQSWKPDDKXJO4J2XTOXD/ | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZKM5G3YNSZDHDZMPCMAHG5B5M2V4XYSE/ | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://security.gentoo.org/glsa/202007-03 | Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cacti | cacti | 1.2.12 | |
| fedoraproject | fedora | 31 | |
| fedoraproject | fedora | 32 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cacti:cacti:1.2.12:*:*:*:*:*:*:*",
"matchCriteriaId": "697145F3-CB18-45CF-9671-148B10B2F3F5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*",
"matchCriteriaId": "80F0FA5D-8D3B-4C0E-81E2-87998286AF33",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*",
"matchCriteriaId": "36D96259-24BD-44E2-96D9-78CE1D41F956",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A SQL injection issue in color.php in Cacti 1.2.12 allows an admin to inject SQL via the filter parameter. This can lead to remote command execution because the product accepts stacked queries."
},
{
"lang": "es",
"value": "Un problema de inyecci\u00f3n SQL en el archivo color.php en Cacti versi\u00f3n 1.2.12, permite a un administrador inyectar SQL por medio del par\u00e1metro filter. Esto puede conllevar a una ejecuci\u00f3n de comandos remota porque el producto acepta consultas en pila"
}
],
"id": "CVE-2020-14295",
"lastModified": "2024-11-21T05:02:56.827",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.2,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2020-06-17T14:15:10.617",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Broken Link"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00067.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Broken Link"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00085.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "http://packetstormsecurity.com/files/162384/Cacti-1.2.12-SQL-Injection-Remote-Code-Execution.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "http://packetstormsecurity.com/files/162918/Cacti-1.2.12-SQL-Injection-Remote-Command-Execution.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Issue Tracking",
"Third Party Advisory"
],
"url": "https://github.com/Cacti/cacti/issues/3622"
},
{
"source": "cve@mitre.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W64CIB6L4HZRVQSWKPDDKXJO4J2XTOXD/"
},
{
"source": "cve@mitre.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZKM5G3YNSZDHDZMPCMAHG5B5M2V4XYSE/"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://security.gentoo.org/glsa/202007-03"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Broken Link"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00067.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Broken Link"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00085.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "http://packetstormsecurity.com/files/162384/Cacti-1.2.12-SQL-Injection-Remote-Code-Execution.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "http://packetstormsecurity.com/files/162918/Cacti-1.2.12-SQL-Injection-Remote-Command-Execution.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Issue Tracking",
"Third Party Advisory"
],
"url": "https://github.com/Cacti/cacti/issues/3622"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W64CIB6L4HZRVQSWKPDDKXJO4J2XTOXD/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZKM5G3YNSZDHDZMPCMAHG5B5M2V4XYSE/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://security.gentoo.org/glsa/202007-03"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-89"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…