Все бюллетени/c10f1/ALT-PU-2024-17822-3
ALT-PU-2024-17822-3

Обновление пакета cacti в ветке c10f1

Версия1.2.28-alt1
Задание#367392
Опубликовано2025-01-05
Макс. серьёзностьCRITICAL
Серьёзность:

Закрытые проблемы (24)

BDU:2024-04119
HIGH8.0

Уязвимость функции api_plugin_hook() программного средства мониторинга сети Cacti, позволяющая нарушителю выполнить произвольный код

Опубликовано: 2024-05-27
CVSS 3.xВЫСОКАЯ 8.0
CVSS:3.x/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS 2.0ВЫСОКАЯ 7.1
CVSS:2.0/AV:N/AC:H/Au:S/C:C/I:C/A:C
Ссылки
BDU:2024-04179
MEDIUM4.6

Уязвимость функции form_save() программного средства мониторинга сети Cacti, позволяющая нарушителю выполнять произвольные SQL-запросы

Опубликовано: 2024-05-29
CVSS 3.xСРЕДНЯЯ 4.6
CVSS:3.x/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L
CVSS 2.0СРЕДНЯЯ 5.5
CVSS:2.0/AV:N/AC:L/Au:S/C:N/I:P/A:P
Ссылки
BDU:2024-04180
HIGH8.8

Уязвимость функции automation_get_new_graphs_sql программного средства мониторинга сети Cacti, позволяющая нарушителю выполнять произвольные SQL-запросы

Опубликовано: 2024-05-29
CVSS 3.xВЫСОКАЯ 8.8
CVSS:3.x/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0КРИТИЧЕСКАЯ 9.0
CVSS:2.0/AV:N/AC:L/Au:S/C:C/I:C/A:C
Ссылки
BDU:2024-04181
MEDIUM6.5

Уязвимость функции create_all_header_nodes() программного средства мониторинга сети Cacti, позволяющая нарушителю выполнять произвольные SQL-запросы

Опубликовано: 2024-05-29Изменено: 2024-09-06
CVSS 3.xСРЕДНЯЯ 6.5
CVSS:3.x/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CVSS 2.0СРЕДНЯЯ 6.8
CVSS:2.0/AV:N/AC:L/Au:S/C:N/I:C/A:N
Ссылки
BDU:2024-05742
CRITICAL9.1

Уязвимость функции import_package() (lib/import.php) программного средства мониторинга сети Cacti, позволяющая нарушителю выполнить произвольный PHP-код

Опубликовано: 2024-07-25
CVSS 3.xКРИТИЧЕСКАЯ 9.1
CVSS:3.x/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS 2.0КРИТИЧЕСКАЯ 9.0
CVSS:2.0/AV:N/AC:L/Au:S/C:C/I:C/A:C
Ссылки
BDU:2024-05743
HIGH7.6

Уязвимость программного средства мониторинга сети Cacti, существующая из-за непринятия мер по защите структуры веб-страницы, позволяющая нарушителю выполнить межсайтовый скриптинг

Опубликовано: 2024-07-25
CVSS 3.xВЫСОКАЯ 7.6
CVSS:3.x/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:H
CVSS 2.0ВЫСОКАЯ 8.7
CVSS:2.0/AV:N/AC:L/Au:S/C:C/I:P/A:C
Ссылки
BDU:2024-05744
MEDIUM4.6

Уязвимость функции automation_tree_rules_form_save() (automation_tree_rules.php) программного средства мониторинга сети Cacti, позволяющая нарушителю провести атаку межстайтового скриптинга (XSS)

Опубликовано: 2024-07-25Изменено: 2024-12-27
CVSS 3.xСРЕДНЯЯ 4.6
CVSS:3.x/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L
CVSS 2.0СРЕДНЯЯ 5.5
CVSS:2.0/AV:N/AC:L/Au:S/C:N/I:P/A:P
Ссылки
BDU:2024-05745
MEDIUM4.6

Уязвимость функции form_save() (data_queries.php) программного средства мониторинга сети Cacti, позволяющая нарушителю выполнить межсайтовый скриптинг

Опубликовано: 2024-07-25Изменено: 2024-12-27
CVSS 3.xСРЕДНЯЯ 4.6
CVSS:3.x/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
CVSS 2.0СРЕДНЯЯ 5.5
CVSS:2.0/AV:N/AC:L/Au:S/C:P/I:P/A:N
Ссылки
BDU:2024-07867
HIGH7.2

Уязвимость программного средства мониторинга сети Cacti, связанная с неверным управлением генерацией кода, позволяющая нарушителю выполнить произвольный код

Опубликовано: 2024-10-08
CVSS 3.xВЫСОКАЯ 7.2
CVSS:3.x/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0КРИТИЧЕСКАЯ 9.0
CVSS:2.0/AV:N/AC:L/Au:S/C:C/I:C/A:C
Ссылки
BDU:2024-08721
HIGH7.3

Уязвимость сценария links.php программного средства мониторинга сети Cacti, позволяющая нарушителю проводить межсайтовые сценарные атаки

Опубликовано: 2024-10-29Изменено: 2025-11-05
CVSS 3.xВЫСОКАЯ 7.3
CVSS:3.x/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H
CVSS 2.0ВЫСОКАЯ 8.5
CVSS:2.0/AV:N/AC:L/Au:S/C:C/I:N/A:C
Ссылки
BDU:2024-08740
HIGH8.2

Уязвимость сценария links.php программного средства мониторинга сети Cacti, позволяющая нарушителю проводить межсайтовые сценарные атаки

Опубликовано: 2024-10-30
CVSS 3.xВЫСОКАЯ 8.2
CVSS:3.x/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:H
CVSS 2.0ВЫСОКАЯ 8.0
CVSS:2.0/AV:N/AC:L/Au:S/C:P/I:P/A:C
Ссылки
CVE-2024-25641
HIGH7.2

Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, an arbitrary file write vulnerability, exploitable through the "Package Import" feature, allows authenticated users having the "Import Templates" permission to execute arbitrary PHP code on the web server. The vulnerability is located within the `import_package()` function defined into the `/lib/import.php` script. The function blindly trusts the filename and file content provided within the XML data, and writes such files into the Cacti base path (or even outside, since path traversal sequences are not filtered). This can be exploited to write or overwrite arbitrary files on the web server, leading to execution of arbitrary PHP code or other security impacts. Version 1.2.27 contains a patch for this issue.

Опубликовано: 2024-05-14Изменено: 2025-11-04
CVSS 3.xВЫСОКАЯ 7.2
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Ссылки
CVE-2024-27082
MEDIUM5.4

Cacti provides an operational monitoring and fault management framework. Versions of Cacti prior to 1.2.27 are vulnerable to stored cross-site scripting, a type of cross-site scripting where malicious scripts are permanently stored on a target server and served to users who access a particular page. Version 1.2.27 contains a patch for the issue.

Опубликовано: 2024-05-14Изменено: 2024-12-18
CVSS 3.xСРЕДНЯЯ 5.4
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Ссылки
CVE-2024-29894
MEDIUM4.7

Cacti provides an operational monitoring and fault management framework. Versions of Cacti prior to 1.2.27 contain a residual cross-site scripting vulnerability caused by an incomplete fix for CVE-2023-50250. `raise_message_javascript` from `lib/functions.php` now uses purify.js to fix CVE-2023-50250 (among others). However, it still generates the code out of unescaped PHP variables `$title` and `$header`. If those variables contain single quotes, they can be used to inject JavaScript code. An attacker exploiting this vulnerability could execute actions on behalf of other users. This ability to impersonate users could lead to unauthorized changes to settings. Version 1.2.27 fixes this issue.

Опубликовано: 2024-05-14Изменено: 2024-12-18
CVSS 3.xСРЕДНЯЯ 4.7
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N
Ссылки
CVE-2024-31443
MEDIUM5.4

Cacti provides an operational monitoring and fault management framework. Prior to 1.2.27, some of the data stored in `form_save()` function in `data_queries.php` is not thoroughly checked and is used to concatenate the HTML statement in `grow_right_pane_tree()` function from `lib/html.php` , finally resulting in cross-site scripting. Version 1.2.27 contains a patch for the issue.

Опубликовано: 2024-05-14Изменено: 2025-11-04
CVSS 3.xСРЕДНЯЯ 5.4
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Ссылки
CVE-2024-31444
MEDIUM5.4

Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, some of the data stored in `automation_tree_rules_form_save()` function in `automation_tree_rules.php` is not thoroughly checked and is used to concatenate the HTML statement in `form_confirm()` function from `lib/html.php` , finally resulting in cross-site scripting. Version 1.2.27 contains a patch for the issue.

Опубликовано: 2024-05-14Изменено: 2025-11-04
CVSS 3.xСРЕДНЯЯ 5.4
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Ссылки
CVE-2024-31445
HIGH8.8

Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, a SQL injection vulnerability in `automation_get_new_graphs_sql` function of `api_automation.php` allows authenticated users to exploit these SQL injection vulnerabilities to perform privilege escalation and remote code execution. In `api_automation.php` line 856, the `get_request_var('filter')` is being concatenated into the SQL statement without any sanitization. In `api_automation.php` line 717, The filter of `'filter'` is `FILTER_DEFAULT`, which means there is no filter for it. Version 1.2.27 contains a patch for the issue.

Опубликовано: 2024-05-14Изменено: 2025-11-04
CVSS 3.xВЫСОКАЯ 8.8
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Ссылки
CVE-2024-31458
HIGH8.0

Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, some of the data stored in `form_save()` function in `graph_template_inputs.php` is not thoroughly checked and is used to concatenate the SQL statement in `draw_nontemplated_fields_graph_item()` function from `lib/html_form_templates.php` , finally resulting in SQL injection. Version 1.2.27 contains a patch for the issue.

Опубликовано: 2024-05-14Изменено: 2025-11-04
CVSS 3.xВЫСОКАЯ 8.0
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Ссылки
CVE-2024-31459
HIGH7.2

Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, there is a file inclusion issue in the `lib/plugin.php` file. Combined with SQL injection vulnerabilities, remote code execution can be implemented. There is a file inclusion issue with the `api_plugin_hook()` function in the `lib/plugin.php` file, which reads the plugin_hooks and plugin_config tables in database. The read data is directly used to concatenate the file path which is used for file inclusion. Version 1.2.27 contains a patch for the issue.

Опубликовано: 2024-05-14Изменено: 2025-11-04
CVSS 3.xВЫСОКАЯ 7.2
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Ссылки
CVE-2024-31460
HIGH8.8

Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, some of the data stored in `automation_tree_rules.php` is not thoroughly checked and is used to concatenate the SQL statement in `create_all_header_nodes()` function from `lib/api_automation.php` , finally resulting in SQL injection. Using SQL based secondary injection technology, attackers can modify the contents of the Cacti database, and based on the modified content, it may be possible to achieve further impact, such as arbitrary file reading, and even remote code execution through arbitrary file writing. Version 1.2.27 contains a patch for the issue.

Опубликовано: 2024-05-14Изменено: 2025-11-04
CVSS 3.xВЫСОКАЯ 8.8
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Ссылки
CVE-2024-34340
CRITICAL9.1

Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, Cacti calls `compat_password_hash` when users set their password. `compat_password_hash` use `password_hash` if there is it, else use `md5`. When verifying password, it calls `compat_password_verify`. In `compat_password_verify`, `password_verify` is called if there is it, else use `md5`. `password_verify` and `password_hash` are supported on PHP < 5.5.0, following PHP manual. The vulnerability is in `compat_password_verify`. Md5-hashed user input is compared with correct password in database by `$md5 == $hash`. It is a loose comparison, not `===`. It is a type juggling vulnerability. Version 1.2.27 contains a patch for the issue.

Опубликовано: 2024-05-14Изменено: 2025-11-04
CVSS 3.xКРИТИЧЕСКАЯ 9.1
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Ссылки
CVE-2024-43362
MEDIUM5.4

Cacti is an open source performance and fault management framework. The `fileurl` parameter is not properly sanitized when saving external links in `links.php` . Morever, the said fileurl is placed in some html code which is passed to the `print` function in `link.php` and `index.php`, finally leading to stored XSS. Users with the privilege to create external links can manipulate the `fileurl` parameter in the http post request while creating external links to perform stored XSS attacks. The vulnerability known as XSS (Cross-Site Scripting) occurs when an application allows untrusted user input to be displayed on a web page without proper validation or escaping. This issue has been addressed in release version 1.2.28. All users are advised to upgrade. There are no known workarounds for this issue.

Опубликовано: 2024-10-07Изменено: 2025-11-03
CVSS 3.xСРЕДНЯЯ 5.4
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Ссылки
CVE-2024-43363
HIGH7.2

Cacti is an open source performance and fault management framework. An admin user can create a device with a malicious hostname containing php code and repeat the installation process (completing only step 5 of the installation process is enough, no need to complete the steps before or after it) to use a php file as the cacti log file. After having the malicious hostname end up in the logs (log poisoning), one can simply go to the log file url to execute commands to achieve RCE. This issue has been addressed in version 1.2.28 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

Опубликовано: 2024-10-07Изменено: 2025-11-03
CVSS 3.xВЫСОКАЯ 7.2
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Ссылки
CVE-2024-43364
HIGH8.2

Cacti is an open source performance and fault management framework. The `title` parameter is not properly sanitized when saving external links in links.php . Morever, the said title parameter is stored in the database and reflected back to user in index.php, finally leading to stored XSS. Users with the privilege to create external links can manipulate the `title` parameter in the http post request while creating external links to perform stored XSS attacks. The vulnerability known as XSS (Cross-Site Scripting) occurs when an application allows untrusted user input to be displayed on a web page without proper validation or escaping. This issue has been addressed in release version 1.2.28. All users are advised to upgrade. There are no known workarounds for this vulnerability.

Опубликовано: 2024-10-07Изменено: 2025-11-03
CVSS 3.xВЫСОКАЯ 8.2
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:H
Ссылки