Unrated
Cacti 1.2.8 allows Remote Code Execution (by privileged users) via shell metacharacters in the Performance Boost Debug Log field of poller_automation....
CVE-2020-7237
First seen on SecPulse
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2020-7237 cacti Fixed in: 1.2.9+ds1-1
Original description The description as published by the source.
Cacti 1.2.8 allows Remote Code Execution (by privileged users) via shell metacharacters in the Performance Boost Debug Log field of poller_automation.php. OS commands are executed when a new poller cycle begins. The attacker must be authenticated, and must have access to modify the Performance Settings of the product.
References
- advisory ctrsec.io
- advisory security.gentoo.org
- report github.com
- web lists.opensuse.org
- web lists.opensuse.org
- web lists.opensuse.org
- web lists.opensuse.org
- web lists.fedoraproject.org
- web lists.fedoraproject.org