Skip to content
OpenAdvisories
Critical USN-6969-1 9 CVEs

cacti vulnerabilities

Published Aug 20, 2024 · Updated Jun 29, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Cacti did not properly apply checks to the "Package
Import" feature. An attacker could possibly use this issue to perform
arbitrary code execution. This issue only affected Ubuntu 24.04 LTS, Ubuntu
22.04 LTS, Ubuntu 20.04 LTS and Ubuntu 18.04 LTS. (CVE-2024-25641)

It was discovered that Cacti did not properly sanitize values when using
javascript based API. A remote attacker could possibly use this issue to
inject arbitrary javascript code resulting into cross-site scripting
vulnerability. This issue only affected Ubuntu 24.04 LTS. (CVE-2024-29894)

It was discovered that Cacti did not properly sanitize values when managing
data queries. A remote attacker could possibly use this issue to inject
arbitrary javascript code resulting into cross-site scripting
vulnerability. (CVE-2024-31443)

It was discovered that Cacti did not properly sanitize values when reading
tree rules with Automation API. A remote attacker could possibly use this
issue to inject arbitrary javascript code resulting into cross-site
scripting vulnerability. (CVE-2024-31444)

It was discovered that Cacti did not properly sanitize
"get_request_var('filter')" values in the "api_automation.php" file. A
remote attacker could possibly use this issue to perform SQL injection
attacks. This issue only affected Ubuntu 24.04 LTS, Ubuntu 22.04 LTS,
Ubuntu 20.04 LTS and Ubuntu 18.04 LTS. (CVE-2024-31445)

It was discovered that Cacti did not properly sanitize data stored in
"form_save()" function in the "graph_template_inputs.php" file. A remote
attacker could possibly use this issue to perform SQL injection attacks.
(CVE-2024-31458)

It was discovered that Cacti did not properly validate the file urls from
the lib/plugin.php file. An attacker could possibly use this issue to
perform arbitrary code execution. (CVE-2024-31459)

It was discovered that Cacti did not properly validate the data stored in
the "automation_tree_rules.php". A remote attacker could possibly use this
issue to perform SQL injection attacks. This issue only affected Ubuntu
24.04 LTS, Ubuntu 22.04 LTS, Ubuntu 20.04 LTS and Ubuntu 18.04 LTS.
(CVE-2024-31460)

It was discovered that Cacti did not properly verify the user password.
An attacker could possibly use this issue to bypass authentication
mechanism. This issue only affected Ubuntu 24.04 LTS, Ubuntu 22.04 LTS,
Ubuntu 20.04 LTS and Ubuntu 18.04 LTS. (CVE-2024-34360)

Fixed packages 6

ReleasePackageFixed in
Ubuntu · 20.04 LTS 20.04:LTS cacti 1.2.10+ds1-1ubuntu1.1
Ubuntu · 22.04 LTS 22.04:LTS cacti 1.2.19+ds1-2ubuntu1.1
Ubuntu · 24.04 LTS 24.04:LTS cacti 1.2.26+ds1-1ubuntu0.1
Ubuntu · Pro 14.04 LTS Pro:14.04:LTS cacti 0.8.8b+dfsg-5ubuntu0.2+esm2
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS cacti 0.8.8f+ds1-4ubuntu4.16.04.2+esm2
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS cacti 1.1.38+ds1-1ubuntu0.1~esm3

Vulnerabilities 9

  • Critical 9.1
    CVE-2024-25641 Public exploit EPSS 86%

    Cacti RCE vulnerability when importing packages

    Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, an arbitrary file write vulnerability, exploitable through the "Package Import" feature, allows authenticated users having the "Import Templates" permission to e…

    Cacti cacti cacti cacti Debian Ubuntu Alpine
  • Critical 9.1
    CVE-2024-34340

    Authentication Bypass when using using older password hashes

    Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, Cacti calls `compat_password_hash` when users set their password. `compat_password_hash` use `password_hash` if there is it, else use `md5`. When verifying passw…

    Cacti cacti cacti cacti Debian Ubuntu Alpine
  • High 8.8
    CVE-2024-31445 EPSS 26%

    SQL Injection vulnerability in automation_get_new_graphs_sql

    Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, a SQL injection vulnerability in `automation_get_new_graphs_sql` function of `api_automation.php` allows authenticated users to exploit these SQL injection vulne…

    Cacti cacti cacti cacti Debian Ubuntu Alpine
  • High 8.1
    CVE-2024-31459

    Cacti RCE vulnerability by file include in lib/plugin.php

    Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, there is a file inclusion issue in the `lib/plugin.php` file. Combined with SQL injection vulnerabilities, remote code execution can be implemented. There is a f…

    Cacti cacti cacti cacti Debian Ubuntu Alpine
  • Medium 6.5
    CVE-2024-31460

    Cacti SQL Injection vulnerability in lib/api_automation.php caused by reading dirty data stored in database

    Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, some of the data stored in `automation_tree_rules.php` is not thoroughly checked and is used to concatenate the SQL statement in `create_all_header_nodes()` func…

    Cacti cacti cacti cacti Debian Ubuntu Alpine
  • Medium 5.7
    CVE-2024-31443

    Cacti XSS vulnerability in lib/html_tree.php by reading dirty data stored in database

    Cacti provides an operational monitoring and fault management framework. Prior to 1.2.27, some of the data stored in `form_save()` function in `data_queries.php` is not thoroughly checked and is used to concatenate the HTML statement in `grow_right_pane_tree(…

    Cacti cacti cacti cacti Debian Ubuntu Alpine
  • Medium 5.4
    CVE-2024-29894

    Cacti Cross-site Scripting vulnerability when using JavaScript based messaging API

    Cacti provides an operational monitoring and fault management framework. Versions of Cacti prior to 1.2.27 contain a residual cross-site scripting vulnerability caused by an incomplete fix for CVE-2023-50250. `raise_message_javascript` from `lib/functions.php…

    Cacti cacti cacti cacti Debian Ubuntu Alpine
  • Medium 4.6
    CVE-2024-31444 EPSS 15%

    Cacti XSS vulnerability in lib/html.php by reading dirty data stored in database

    Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, some of the data stored in `automation_tree_rules_form_save()` function in `automation_tree_rules.php` is not thoroughly checked and is used to concatenate the H…

    Cacti cacti cacti cacti Debian Ubuntu Alpine
  • Medium 4.6
    CVE-2024-31458 EPSS 13%

    Cacti SQL Injection vulnerability in lib/html_form_templates.php by reading dirty data stored in database

    Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, some of the data stored in `form_save()` function in `graph_template_inputs.php` is not thoroughly checked and is used to concatenate the SQL statement in `draw_…

    Cacti cacti cacti cacti Debian Ubuntu Alpine

References

  • report
    https://ubuntu.com/security/CVE-2024-25641
  • report
    https://ubuntu.com/security/CVE-2024-29894
  • report
    https://ubuntu.com/security/CVE-2024-31443
  • report
    https://ubuntu.com/security/CVE-2024-31444
  • report
    https://ubuntu.com/security/CVE-2024-31445
  • report
    https://ubuntu.com/security/CVE-2024-31458
  • report
    https://ubuntu.com/security/CVE-2024-31459
  • report
    https://ubuntu.com/security/CVE-2024-31460
  • report
    https://ubuntu.com/security/CVE-2024-34340