SB2020030103 - OpenSUSE Linux update for cacti, cacti-spine

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2020030103

SB2020030103 - OpenSUSE Linux update for cacti, cacti-spine

Published: March 1, 2020 Updated: May 19, 2022

Security Bulletin ID SB2020030103
Severity
High
Patch available
YES
Number of vulnerabilities 10
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 20% Medium 20% Low 60%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 10 secuirty vulnerabilities.


1) OS Command Injection (CVE-ID: CVE-2009-4112)

The vulnerability allows a remote user to execute arbitrary shell commands on the target system.

The vulnerability exists due to the application allows authenticated administrators to update the "Data Input Method" for the "Linux - Get Memory Usage" setting and insert arbitrary system command. A remote authenticated administrator can execute arbitrary OS commands on the system.



2) Cross-site scripting (CVE-ID: CVE-2018-20723)

The vulnerability allows a remote privileged user to read and manipulate data.

A cross-site scripting (XSS) vulnerability exists in color_templates.php in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Name field for a Color.


3) Cross-site scripting (CVE-ID: CVE-2018-20724)

The vulnerability allows a remote privileged user to read and manipulate data.

A cross-site scripting (XSS) vulnerability exists in pollers.php in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Website Hostname for Data Collectors.


4) Cross-site scripting (CVE-ID: CVE-2018-20725)

The vulnerability allows a remote privileged user to read and manipulate data.

A cross-site scripting (XSS) vulnerability exists in graph_templates.php in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Graph Vertical Label.


5) Cross-site scripting (CVE-ID: CVE-2018-20726)

The vulnerability allows a remote authenticated user to read and manipulate data.

A cross-site scripting (XSS) vulnerability exists in host.php (via tree.php) in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Website Hostname field for Devices.


6) Improper Access Control (CVE-ID: CVE-2019-16723)

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to the system's authorization functionality does not prevent gaining access to user's data or record by modifying the key value identifying the data. A remote authenticated attacker can send a specially crafted request to the "graph_json.php" file with a modified "local_graph_id" parameter and view the graph data.

7) SQL injection (CVE-ID: CVE-2019-17357)

The vulnerability allows a remote attacker to execute arbitrary SQL queries in database.

The vulnerability exists due to insufficient sanitization of user-supplied data in graphs.php. A remote attacker can send a specially crafted request to the affected application and execute arbitrary SQL commands within the application database.

Successful exploitation of this vulnerability may allow a remote attacker to read, delete, modify data in database and gain complete control over the affected application.


8) Deserialization of Untrusted Data (CVE-ID: CVE-2019-17358)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insecure input validation when processing serialized data in lib/functions.php. A remote attacker can pass specially crafted data to the application and execute arbitrary PHP code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


9) Stored cross-site scripting (CVE-ID: CVE-2020-7106)

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data in the "description" parameter. A remote attacker can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

This vulnerability affects the following files:

  • data_sources.php
  • color_templates_item.php
  • graphs.php
  • graph_items.php
  • lib/api_automation.php
  • user_admin.php
  • user_group_admin.php

10) Input validation error (CVE-ID: CVE-2020-7237)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insufficient validation of user-supplied input in the Performance Boost Debug Log field of "poller_automation.php". A remote authenticated attacker can execute arbitrary code via shell metacharacters.


Remediation

Install update from vendor's website.

References