Skip to content
OpenAdvisories
High WID-SEC-2024-1095 9 CVEs

Cacti: Mehrere Schwachstellen

Published May 12, 2024 · Updated Sep 9, 2024 · Revision 5 · de-DE

Vendor: Debian Vendor: Fedora Vendor: SUSE Vendor: Ubuntu Product: Linux Product: Linux Product: Linux Product: openSUSE Platform: Linux Platform: Windows

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Cacti ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Code auszuführen oder und SQL-Injection oder Cross-Site-Scripting Angriffe durchzuführen.

Product

Cacti ist ein grafisches Frontend zur Visualisierung von statistischen Daten, erfasst durch die Round Robin Database rrdtool.

Vulnerabilities 9

  • Critical 9.1
    CVE-2024-25641 Public exploit EPSS 86%

    Cacti RCE vulnerability when importing packages

    Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, an arbitrary file write vulnerability, exploitable through the "Package Import" feature, allows authenticated users having the "Import Templates" permission to e…

    Cacti cacti cacti cacti Debian Ubuntu Alpine
  • Critical 9.1
    CVE-2024-34340

    Authentication Bypass when using using older password hashes

    Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, Cacti calls `compat_password_hash` when users set their password. `compat_password_hash` use `password_hash` if there is it, else use `md5`. When verifying passw…

    Cacti cacti cacti cacti Debian Ubuntu Alpine
  • High 8.8
    CVE-2024-31445 EPSS 26%

    SQL Injection vulnerability in automation_get_new_graphs_sql

    Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, a SQL injection vulnerability in `automation_get_new_graphs_sql` function of `api_automation.php` allows authenticated users to exploit these SQL injection vulne…

    Cacti cacti cacti cacti Debian Ubuntu Alpine
  • High 8.1
    CVE-2024-31459

    Cacti RCE vulnerability by file include in lib/plugin.php

    Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, there is a file inclusion issue in the `lib/plugin.php` file. Combined with SQL injection vulnerabilities, remote code execution can be implemented. There is a f…

    Cacti cacti cacti cacti Debian Ubuntu Alpine
  • Medium 6.5
    CVE-2024-31460

    Cacti SQL Injection vulnerability in lib/api_automation.php caused by reading dirty data stored in database

    Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, some of the data stored in `automation_tree_rules.php` is not thoroughly checked and is used to concatenate the SQL statement in `create_all_header_nodes()` func…

    Cacti cacti cacti cacti Debian Ubuntu Alpine
  • Medium 5.7
    CVE-2024-31443

    Cacti XSS vulnerability in lib/html_tree.php by reading dirty data stored in database

    Cacti provides an operational monitoring and fault management framework. Prior to 1.2.27, some of the data stored in `form_save()` function in `data_queries.php` is not thoroughly checked and is used to concatenate the HTML statement in `grow_right_pane_tree(…

    Cacti cacti cacti cacti Debian Ubuntu Alpine
  • Medium 5.4
    CVE-2024-29894

    Cacti Cross-site Scripting vulnerability when using JavaScript based messaging API

    Cacti provides an operational monitoring and fault management framework. Versions of Cacti prior to 1.2.27 contain a residual cross-site scripting vulnerability caused by an incomplete fix for CVE-2023-50250. `raise_message_javascript` from `lib/functions.php…

    Cacti cacti cacti cacti Debian Ubuntu Alpine
  • Medium 4.6
    CVE-2024-31444 EPSS 15%

    Cacti XSS vulnerability in lib/html.php by reading dirty data stored in database

    Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, some of the data stored in `automation_tree_rules_form_save()` function in `automation_tree_rules.php` is not thoroughly checked and is used to concatenate the H…

    Cacti cacti cacti cacti Debian Ubuntu Alpine
  • Medium 4.6
    CVE-2024-31458 EPSS 13%

    Cacti SQL Injection vulnerability in lib/html_form_templates.php by reading dirty data stored in database

    Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, some of the data stored in `form_save()` function in `graph_template_inputs.php` is not thoroughly checked and is used to concatenate the SQL statement in `draw_…

    Cacti cacti cacti cacti Debian Ubuntu Alpine

Revision history

  1. #5

    Neue Updates von Debian aufgenommen

  2. #4

    Neue Updates von openSUSE aufgenommen

  3. #3

    Neue Updates von Ubuntu aufgenommen

  4. #2

    Neue Updates von Fedora aufgenommen

  5. #1

    Initiale Fassung

References