Description
Cross-site request forgery (CSRF) vulnerability in Cacti 0.8.7g, 0.8.8b, and earlier allows remote attackers to hijack the authentication of users for unspecified commands, as demonstrated by requests that (1) modify binary files, (2) modify configurations, or (3) add arbitrary users.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | cacti | 0.8.8b+dfsg-6 | — |
| Debian 13 | cacti | 0.8.8b+dfsg-6 | — |
| Debian 12 | cacti | 0.8.8b+dfsg-6 | — |
| Debian 7 | cacti | 0.8.8a+dfsg-5+deb7u3 | DSA-2970-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | cacti | 0.8.8b+dfsg-5ubuntu0.1 | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | cacti | 0.8.8h-1.2 | openSUSE-SU-2024:10084-1 |
Advisories 2
- DSA-2970-1 cacti - security update Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10084-1 cacti-0.8.8h-1.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- JVN#55076671 third-party-advisory
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=742768
- JVNDB-2014-002239 third-party-advisory
- 20140324 Deutsche Telekom CERT Advisory [DTC-A-20140324-001] vulnerabilities in cacti mailing-list
- 59203 third-party-advisory
- openSUSE-SU-2015:0479 vendor-advisory
- 66392 vdb-entry
- DSA-2970 vendor-advisory
- GLSA-201509-03 vendor-advisory