OS Command Injection in Cacti - CVE-2009-4112
Published: April 28, 2020 / Updated: May 7, 2020
Vulnerability identifier: #VU27394
CSH Severity: Low
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2009-4112
CWE-ID: CWE-78
Exploitation vector: Remote access
Exploit availability:
Public exploit is available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary shell commands on the target system.
The vulnerability exists due to the application allows authenticated administrators to update the "Data Input Method" for the "Linux - Get Memory Usage" setting and insert arbitrary system command. A remote authenticated administrator can execute arbitrary OS commands on the system.
Affected software
Cacti
SUSE Package Hub for SUSE Linux Enterprise
SUSE Linux
Opensuse
SUSE Package Hub for SUSE Linux Enterprise
SUSE Linux
Opensuse
How to mitigate CVE-2009-4112
Install updates from vendor's website.
Cacti - update to 0.8.7f