| Description: | Summary:
The remote host is missing an update for the Debian 'cacti' package(s) announced via the DLA-3252-1 advisory.
Vulnerability Insight:
Multiple security vulnerabilities were discovered in cacti, a web interface for graphing of monitoring systems, which may result in information disclosure, authentication bypass, or remote code execution.
CVE-2020-8813
Askar discovered that an authenticated guest user with the graph real-time privilege could execute arbitrary code on a server running Cacti, via shell meta-characters in a cookie.
CVE-2020-23226
Jing Chen discovered multiple Cross Site Scripting (XSS) vulnerabilities in several pages, which can lead to information disclosure.
CVE-2020-25706
joelister discovered an Cross Site Scripting (XSS) vulnerability in templates_import.php, which can lead to information disclosure.
CVE-2022-0730
It has been discovered that Cacti authentication can be bypassed when LDAP anonymous binding is enabled.
CVE-2022-46169
Stefan Schiller discovered a command injection vulnerability, allowing an unauthenticated user to execute arbitrary code on a server running Cacti, if a specific data source was selected (which is likely the case on a production instance) for any monitored device.
For Debian 10 buster, these problems have been fixed in version 1.2.2+ds1-2+deb10u5.
We recommend that you upgrade your cacti packages.
For the detailed security status of cacti please refer to its security tracker page at: [link moved to references]
Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: [link moved to references]
Affected Software/OS:
'cacti' package(s) on Debian 10.
Solution:
Please install the updated package(s).
CVSS Score:
9.3
CVSS Vector:
AV:N/AC:M/Au:N/C:C/I:C/A:C
|
