cacti - security update

Fixed packages 1

Vulnerabilities 9

• Critical 9.1
  CVE-2024-25641 Public exploit EPSS 86%

  Cacti RCE vulnerability when importing packages

  Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, an arbitrary file write vulnerability, exploitable through the "Package Import" feature, allows authenticated users having the "Import Templates" permission to e…

  Cacti cacti cacti cacti Debian Ubuntu Alpine
  May 13, 2024
• Critical 9.1
  CVE-2024-34340

  Authentication Bypass when using using older password hashes

  Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, Cacti calls `compat_password_hash` when users set their password. `compat_password_hash` use `password_hash` if there is it, else use `md5`. When verifying passw…

  Cacti cacti cacti cacti Debian Ubuntu Alpine
  May 13, 2024
• High 8.8
  CVE-2024-31445 EPSS 26%

  SQL Injection vulnerability in automation_get_new_graphs_sql

  Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, a SQL injection vulnerability in `automation_get_new_graphs_sql` function of `api_automation.php` allows authenticated users to exploit these SQL injection vulne…

  Cacti cacti cacti cacti Debian Ubuntu Alpine
  May 13, 2024
• High 8.1
  CVE-2024-31459

  Cacti RCE vulnerability by file include in lib/plugin.php

  Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, there is a file inclusion issue in the `lib/plugin.php` file. Combined with SQL injection vulnerabilities, remote code execution can be implemented. There is a f…

  Cacti cacti cacti cacti Debian Ubuntu Alpine
  May 13, 2024
• Medium 6.5
  CVE-2024-31460

  Cacti SQL Injection vulnerability in lib/api_automation.php caused by reading dirty data stored in database

  Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, some of the data stored in `automation_tree_rules.php` is not thoroughly checked and is used to concatenate the SQL statement in `create_all_header_nodes()` func…

  Cacti cacti cacti cacti Debian Ubuntu Alpine
  May 13, 2024
• Medium 5.7
  CVE-2024-31443

  Cacti XSS vulnerability in lib/html_tree.php by reading dirty data stored in database

  Cacti provides an operational monitoring and fault management framework. Prior to 1.2.27, some of the data stored in `form_save()` function in `data_queries.php` is not thoroughly checked and is used to concatenate the HTML statement in `grow_right_pane_tree(…

  Cacti cacti cacti cacti Debian Ubuntu Alpine
  May 13, 2024
• Medium 4.6
  CVE-2024-31444 EPSS 15%

  Cacti XSS vulnerability in lib/html.php by reading dirty data stored in database

  Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, some of the data stored in `automation_tree_rules_form_save()` function in `automation_tree_rules.php` is not thoroughly checked and is used to concatenate the H…

  Cacti cacti cacti cacti Debian Ubuntu Alpine
  May 13, 2024
• Medium 4.6
  CVE-2024-31458 EPSS 13%

  Cacti SQL Injection vulnerability in lib/html_form_templates.php by reading dirty data stored in database

  Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, some of the data stored in `form_save()` function in `graph_template_inputs.php` is not thoroughly checked and is used to concatenate the SQL statement in `draw_…

  Cacti cacti cacti cacti Debian Ubuntu Alpine
  May 13, 2024
• Unscored —
  CVE-2022-41444

  Cross Site Scripting (XSS) vulnerability in Cacti 1.2.21 via crafted POST request to graphs_new.php.

  cacti cacti Debian Ubuntu
  Aug 22, 2023