Lucene search

[email protected]CVE-2002-1479

HistorySep 01, 2004 - 4:00 a.m.

CVE-2002-1479

2004-09-0104:00:00

[email protected]

web.nvd.nist.gov

cacti

0.6.8

vulnerability

mysql

plaintext credentials

local users

privileges

nvd

4.6 Medium

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

6.6 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.1%

JSON

Cacti before 0.6.8 stores a MySQL username and password in plaintext in config.php, which has world-readable permissions, which allows local users to modify databases as the Cacti user and possibly gain privileges.

Affected configurations

NVD

Node

the_cacti_groupcactiMatch0.5

the_cacti_groupcactiMatch0.6

the_cacti_groupcactiMatch0.6.1

the_cacti_groupcactiMatch0.6.2

the_cacti_groupcactiMatch0.6.3

the_cacti_groupcactiMatch0.6.4

the_cacti_groupcactiMatch0.6.5

the_cacti_groupcactiMatch0.6.6

the_cacti_groupcactiMatch0.6.7

the_cacti_groupcactiMatch0.6.8

CPENameOperatorVersion
the_cacti_group:cactithe cacti group cactieq0.5
the_cacti_group:cactithe cacti group cactieq0.6
the_cacti_group:cactithe cacti group cactieq0.6.1
the_cacti_group:cactithe cacti group cactieq0.6.2
the_cacti_group:cactithe cacti group cactieq0.6.3
the_cacti_group:cactithe cacti group cactieq0.6.4
the_cacti_group:cactithe cacti group cactieq0.6.5
the_cacti_group:cactithe cacti group cactieq0.6.6
the_cacti_group:cactithe cacti group cactieq0.6.7
the_cacti_group:cactithe cacti group cactieq0.6.8

CPE	Name	Operator	Version
the_cacti_group:cacti	the cacti group cacti	eq	0.5
the_cacti_group:cacti	the cacti group cacti	eq	0.6
the_cacti_group:cacti	the cacti group cacti	eq	0.6.1
the_cacti_group:cacti	the cacti group cacti	eq	0.6.2
the_cacti_group:cacti	the cacti group cacti	eq	0.6.3
the_cacti_group:cacti	the cacti group cacti	eq	0.6.4
the_cacti_group:cacti	the cacti group cacti	eq	0.6.5
the_cacti_group:cacti	the cacti group cacti	eq	0.6.6
the_cacti_group:cacti	the cacti group cacti	eq	0.6.7
the_cacti_group:cacti	the cacti group cacti	eq	0.6.8

References

archives.neohapsis.com/archives/bugtraq/2002-09/0028.html

www.iss.net/security_center/static/10049.php

www.knights-of-the-routing-table.org/advisories/krt_001_20020903_cacti.txt

www.securityfocus.com/bid/5628

4.6 Medium

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

6.6 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.1%

JSON

Related for CVE-2002-1479

debiancve1 nvd1 cvelist1