CVE-2020-8813: cacti
Vulnerability summary
CVE-2020-8813 is a high (CVSS 9.3) vulnerability in cacti. EPSS estimates a 73.96% chance of exploitation in the next 30 days, higher than 99.4% of scored vulnerabilities. 6 public exploits are recorded.
Public exploit (exploit-database, 03-02-2020)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 4 · Related 3Timeline
- 22-02-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
graph_realtime.php in Cacti 1.2.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in a cookie, if a guest user has the graph real-time privilege.
CVSS metrics
5 scores · 4 sources · 2 versions- OSV · DebianEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- NVDNIST8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · AlpineEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
73.96%
Chance of exploitation in the next 30 days
Percentile
99%
Versus all other CVEs
30-day change
No change 0.00 pp
From 73.96% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
6 foundEbe6B74C32Fd0F7E1Eedf1Aabfd44129
Maturity: poc
Exploit Reference (drive.google.com)
Maturity: unknown
Exploit Reference (shells.systems)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Debian2 products
- cacti< 1.2.10+ds1-1
- debian_linuxEOL10.0
Alpine1 product
- cacti< 1.2.8-r0
Cacti1 product
- cacti1.2.8
Fedoraproject1 product
- fedoraEOL30 | 31 | 32
Opmantek1 product
- open-audit3.3.1
Ubuntu1 product
- cactiAll versions (No fix recorded)
6 vendors · 7 products
References
21 links- shells.systems/cacti-v1-2-8-authenticated-remote-code-execution-cve-2020-8813/REPORTExploitThird Party Advisory
- packetstormsecurity.com/files/156538/Cacti-1.2.8-Authenticated-Remote-Code-Execution.htmlThird Party AdvisoryVDB Entry
- packetstormsecurity.com/files/156537/Cacti-1.2.8-Unauthenticated-Remote-Code-Execution.htmlThird Party AdvisoryVDB Entry
- packetstormsecurity.com/files/156593/Cacti-1.2.8-Unauthenticated-Remote-Code-Execution.htmlThird Party AdvisoryVDB Entry
- lists.fedoraproject.org/archives/…Vendor Advisory
- lists.fedoraproject.org/archives/…Vendor Advisory
Show all 21 references
- lists.fedoraproject.org/archives/…Vendor Advisory
- lists.opensuse.org/opensuse-security-announce/2020-04/msg00042.htmlVendor AdvisoryMailing ListThird Party Advisory
- packetstormsecurity.com/files/157477/Open-AudIT-Professional-3.3.1-Remote-Code-Execution.htmlThird Party AdvisoryVDB Entry
- lists.opensuse.org/opensuse-security-announce/2020-04/msg00048.htmlVendor AdvisoryExploitThird Party Advisory
