Debian Security Advisory
DLA-3252-1 cacti -- LTS security update
- Date Reported:
- 31 Dec 2022
- Affected Packages:
- Security database references:
- In the Debian bugtracking system: Bug 951832, Bug 1008693, Bug 1025648.
In Mitre's CVE dictionary: CVE-2020-8813, CVE-2020-23226, CVE-2020-25706, CVE-2022-0730, CVE-2022-46169.
- More information:
Multiple security vulnerabilities were discovered in cacti, a web interface for graphing of monitoring systems, which may result in information disclosure, authentication bypass, or remote code execution.
Askar discovered that an authenticated guest user with the graph real-time privilege could execute arbitrary code on a server running Cacti, via shell meta-characters in a cookie.
Jing Chen discovered multiple Cross Site Scripting (XSS) vulnerabilities in several pages, which can lead to information disclosure.
joelister discovered an Cross Site Scripting (XSS) vulnerability in templates_import.php, which can lead to information disclosure.
It has been discovered that Cacti authentication can be bypassed when LDAP anonymous binding is enabled.
Stefan Schiller discovered a command injection vulnerability, allowing an unauthenticated user to execute arbitrary code on a server running Cacti, if a specific data source was selected (which is likely the case on a production instance) for any monitored device.
For Debian 10 buster, these problems have been fixed in version 1.2.2+ds1-2+deb10u5.
We recommend that you upgrade your cacti packages.
For the detailed security status of cacti please refer to its security tracker page at: https://security-tracker.debian.org/tracker/cacti
Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS