CVE-2020-7237
Summary
| CVE | CVE-2020-7237 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2020-01-20 05:15:00 UTC |
| Updated | 2023-11-07 03:25:00 UTC |
| Description | Cacti 1.2.8 allows Remote Code Execution (by privileged users) via shell metacharacters in the Performance Boost Debug Log field of poller_automation.php. OS commands are executed when a new poller cycle begins. The attacker must be authenticated, and must have access to modify the Performance Settings of the product. |
Risk And Classification
Problem Types: CWE-78
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| [security-announce] openSUSE-SU-2020:0284-1: important: Security update | SUSE | lists.opensuse.org | |
| [SECURITY] Fedora 31 Update: cacti-spine-1.2.9-1.fc31 - package-announce - Fedora Mailing-Lists | FEDORA | lists.fedoraproject.org | |
| [SECURITY] Fedora 31 Update: cacti-spine-1.2.9-1.fc31 - package-announce - Fedora Mailing-Lists | lists.fedoraproject.org | ||
| [SECURITY] Fedora 30 Update: cacti-spine-1.2.9-1.fc30 - package-announce - Fedora Mailing-Lists | FEDORA | lists.fedoraproject.org | |
| [CVE-2020-7237] Remote Code Execution in Cacti RRDTool – Chi Tran | MISC | ctrsec.io | Third Party Advisory |
| [security-announce] openSUSE-SU-2020:0565-1: important: Security update | SUSE | lists.opensuse.org | |
| [security-announce] openSUSE-SU-2020:0558-1: important: Security update | SUSE | lists.opensuse.org | |
| [SECURITY] Fedora 30 Update: cacti-spine-1.2.9-1.fc30 - package-announce - Fedora Mailing-Lists | lists.fedoraproject.org | ||
| Cacti: Multiple vulnerabilities (GLSA 202003-40) — Gentoo security | GENTOO | security.gentoo.org | |
| Remote Code Execution due to input validation failure in Performance Boost Debug Log (CVE-2020-7237) · Issue #3201 · Cacti/cacti · GitHub | MISC | github.com | Exploit, Third Party Advisory |
| [security-announce] openSUSE-SU-2020:0272-1: important: Security update | SUSE | lists.opensuse.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.