Multiple vulnerabilities in Cacti
| Risk | Medium |
| Patch available | YES |
| Number of vulnerabilities | 3 |
| CVE-ID | CVE-2020-13231 CVE-2020-13230 CVE-2019-11358 |
| CWE-ID | CWE-352 CWE-1321 |
| Exploitation vector | Network |
| Public exploit | Public exploit code for vulnerability #3 is available. |
| Vulnerable software Subscribe |
Cacti Web applications / Other software |
| Vendor | The Cacti Group, Inc. |
Security Bulletin
This security bulletin contains information about 3 vulnerabilities.
1) Cross-site request forgery
EUVDB-ID: #VU31877
Risk: Medium
CVSSv3.1: 5.3 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2020-13231
CWE-ID:
CWE-352 - Cross-Site Request Forgery (CSRF)
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform cross-site request forgery attacks.
The vulnerability exists due to insufficient validation of the HTTP request origin in auth_profile.php?action=edit. A remote attacker can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website, such as changing data in victim's profile.
Mitigationinstall updates from vendor's website.
Cacti: 1.2.0 - 1.2.10
External linkshttp://github.com/Cacti/cacti/blob/release/1.2.11/CHANGELOG
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Improper Preservation of Permissions
EUVDB-ID: #VU31878
Risk: Medium
CVSSv3.1: 5.9 [CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2020-13230
CWE-ID: N/A
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to gain access to otherwise restricted functionality.
The vulnerability exists due to application does not properly processes operations, related to accounts deactivation. When disabling a user account the application does not immediately invalidate any permissions
granted to that account (e.g., permission to view logs). A remote attacker, whose account was disabled can still access the application for certain amount of time.
install updates from vendor's website.
Cacti: 1.2.0 - 1.2.10
External linkshttp://github.com/Cacti/cacti/blob/release/1.2.11/CHANGELOG
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
3) Prototype pollution
EUVDB-ID: #VU18092
Risk: Low
CVSSv3.1: 4.8 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C]
CVE-ID: CVE-2019-11358
Exploit availability: Yes
DescriptionThe vulnerability allows a remote attacker to execute arbitrary JavaScript code.
The vulnerability exists due to improper input validation. A remote attacker can pass specially crafted input to the application and perform prototype pollution, which can result in information disclosure or data manipulation.
install updates from vendor's website.
Cacti: 1.2.0 - 1.2.10
External linkshttp://github.com/Cacti/cacti/blob/release/1.2.11/CHANGELOG
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.
