9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
6.8 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
0.004 Low
EPSS
Percentile
74.7%
Package : cacti
Version : 1.2.2+ds1-2+deb10u5
CVE ID : CVE-2020-8813 CVE-2020-23226 CVE-2020-25706 CVE-2022-0730
CVE-2022-46169
Debian Bug : 951832 1008693 1025648
Multiple security vulnerabilities were discovered in cacti, a web
interface for graphing of monitoring systems, which may result in
information disclosure, authentication bypass, or remote code execution.
CVE-2020-8813
Askar discovered that an authenticated guest user with the graph
real-time privilege could execute arbitrary code on a server running
Cacti, via shell meta-characters in a cookie.
CVE-2020-23226
Jing Chen discovered multiple Cross Site Scripting (XSS)
vulnerabilities in several pages, which can lead to information
disclosure.
CVE-2020-25706
joelister discovered an Cross Site Scripting (XSS) vulnerability in
templates_import.php, which can lead to information disclosure.
CVE-2022-0730
It has been discovered that Cacti authentication can be bypassed
when LDAP anonymous binding is enabled.
CVE-2022-46169
Stefan Schiller discovered a command injection vulnerability,
allowing an unauthenticated user to execute arbitrary code on a
server running Cacti, if a specific data source was selected (which
is likely the case on a production instance) for any monitored
device.
For Debian 10 buster, these problems have been fixed in version
1.2.2+ds1-2+deb10u5.
We recommend that you upgrade your cacti packages.
For the detailed security status of cacti please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/cacti
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
Attachment:
signature.asc
Description: PGP signature
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
Debian | 11 | all | cacti | < 1.2.16+ds1-2+deb11u1 | cacti_1.2.16+ds1-2+deb11u1_all.deb |
Debian | 10 | all | cacti | < 1.2.2+ds1-2+deb10u5 | cacti_1.2.2+ds1-2+deb10u5_all.deb |
Debian | 9 | all | cacti | < 0.8.8h+ds1-10+deb9u2 | cacti_0.8.8h+ds1-10+deb9u2_all.deb |
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
6.8 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
0.004 Low
EPSS
Percentile
74.7%