Debian Security Advisory

DLA-3252-1 cacti -- LTS security update

Date Reported:
31 Dec 2022
Affected Packages:
cacti
Vulnerable:
Yes
Security database references:
In the Debian bugtracking system: Bug 951832, Bug 1008693, Bug 1025648.
In Mitre's CVE dictionary: CVE-2020-8813, CVE-2020-23226, CVE-2020-25706, CVE-2022-0730, CVE-2022-46169.
More information:

Multiple security vulnerabilities were discovered in cacti, a web interface for graphing of monitoring systems, which may result in information disclosure, authentication bypass, or remote code execution.

  • CVE-2020-8813

    Askar discovered that an authenticated guest user with the graph real-time privilege could execute arbitrary code on a server running Cacti, via shell meta-characters in a cookie.

  • CVE-2020-23226

    Jing Chen discovered multiple Cross Site Scripting (XSS) vulnerabilities in several pages, which can lead to information disclosure.

  • CVE-2020-25706

    joelister discovered an Cross Site Scripting (XSS) vulnerability in templates_import.php, which can lead to information disclosure.

  • CVE-2022-0730

    It has been discovered that Cacti authentication can be bypassed when LDAP anonymous binding is enabled.

  • CVE-2022-46169

    Stefan Schiller discovered a command injection vulnerability, allowing an unauthenticated user to execute arbitrary code on a server running Cacti, if a specific data source was selected (which is likely the case on a production instance) for any monitored device.

For Debian 10 buster, these problems have been fixed in version 1.2.2+ds1-2+deb10u5.

We recommend that you upgrade your cacti packages.

For the detailed security status of cacti please refer to its security tracker page at: https://security-tracker.debian.org/tracker/cacti

Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS