OPENSUSE-SU-2020:0558-1: cacti-spine&distro=openSUSE Leap 15.1

Published

Published 27-04-2020Last modified 04-02-2026

Vulnerability summary

OPENSUSE-SU-2020:0558-1 is a vulnerability in cacti-spine&distro=openSUSE Leap 15.1 with no CVSS score yet.

Priority

Insufficient evidence

No CVSS vector published; no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

Not scored

010

No CVSS score recorded

EPSS scoreNot scoredRisk metrics not yet published.

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 11 · Downstream 0 · Related 11

CVE-2009-4112 CVE-2018-20723 CVE-2018-20724 CVE-2018-20725 CVE-2018-20726 CVE-2019-16723+5 more

Timeline

27-04-2020
PublishedVulnerability first disclosed.
04-02-2026
Last modifiedVulnerability information updated.

Description

Security update for cacti, cacti-spine This update for cacti, cacti-spine to version 1.2.11 fixes the following issues: This update is fixing multiple vulnerabilities and adding bug fixes. For more details consult the changes file.

CVSS metrics

Risk metrics not yet published.

EPSS trend

No EPSS score has been published for this record yet.

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Version check

Known conditions: not stated in public data.

Opensuse2 products

cacti-spine&distro=openSUSE Leap 15.1< 1.2.11-2.1
cacti&distro=openSUSE Leap 15.1< 1.2.11-5.1

Suse2 products

cacti-spine&distro=SUSE Package Hub 12< 1.2.11-2.1
cacti&distro=SUSE Package Hub 12< 1.2.11-5.1

2 vendors · 4 products

References

23 links

Show all 23 references

Related vulnerabilities

Insufficient evidenceOPENSUSE-SU-2024:0274-1opensuse · cacti-spine&distro=openSUSE Leap 15.5 +5 more2y agoopensuse cacti-spine&distro=openSUSE Leap 15.5Security update for cacti, cacti-spine This update for cacti, cacti-spine fixes the following issues: - cacti 1.2.27: * CVE-2024-34340: Authentication Bypass when using using older password hashes (boo#1224240) * CVE-2024-25641: RCE vulnerability when importing packages (boo#1224229) * CVE-2024-31459: RCE vulnerability when plugins include files (boo#1224238) * CVE-2024-31460: SQL Injection vulnerability when using tree rules through Automation API (boo#1224239) * CVE-2024-29894: XSS vulnerability when using JavaScript based messaging API (boo#1224231) * CVE-2024-31458: SQL Injection vulnerability when using form templates (boo#1224241) * CVE-2024-31444: XSS vulnerability when reading tree rules with Automation API (boo#1224236) * CVE-2024-31443: XSS vulnerability when managing data queries (boo#1224235) * CVE-2024-31445: SQL Injection vulnerability when retrieving graphs using Automation API (boo#1224237) * CVE-2024-27082: XSS vulnerability when managing trees (boo#1224230) * Improve PHP 8.3 support * When importing packages via command line, data source profile could not be selected * When changing password, returning to previous page does not always work * When using LDAP authentication the first time, warnings may appear in logs * When editing/viewing devices, add IPv6 info to hostname tooltip * Improve speed of polling when Boost is enabled * Improve support for Half-Hour time zones * When user session not found, device lists can be incorrectly returned * On import, legacy templates may generate warnings * Improve support for alternate locations of Ping * Improve PHP 8.1 support for Installer * Fix issues with number formatting * Improve PHP 8.1 support when SpikeKill is run first time * Improve PHP 8.1 support for SpikeKill * When using Chinese to search for graphics, garbled characters appear. * When importing templates, preview mode will not always load * When remote poller is installed, MySQL TimeZone DB checks are not performed * When Remote Poller installation completes, no finish button is shown * Unauthorized agents should be recorded into logs * Poller cache may not always update if hostname changes * When using CMD poller, Failure and Recovery dates may have incorrect values * Saving a Tree can cause the tree to become unpublished * Web Basic Authentication does not record user logins * When using Accent-based languages, translations may not work properly * Fix automation expressions for device rules * Improve PHP 8.1 Support during fresh install with boost * Add a device 'enabled/disabled' indicator next to the graphs * Notify the admin periodically when a remote data collector goes into heartbeat status * Add template for Aruba Clearpass * Add fliter/sort of Device Templates by Graph Templates - cacti-spine 1.2.27: * Restore AES SupportCVSSUnscored Insufficient evidenceOPENSUSE-SU-2024:0031-1opensuse · cacti-spine&distro=openSUSE Leap 15.5 +5 more2y agoopensuse cacti-spine&distro=openSUSE Leap 15.5Security update for cacti, cacti-spine This update for cacti, cacti-spine fixes the following issues: cacti-spine 1.2.26: * Fix: Errors when uptime OID is not present * Fix: MySQL reconnect option is depreciated * Fix: Spine does not check a host with no poller items * Fix: Poller may report the wrong number of devices polled * Feature: Allow users to override the threads setting at the command line * Feature: Allow spine to run in ping-only mode cacti 1.2.26: * CVE-2023-50250: XSS vulnerability when importing a template file (boo#1218380) * CVE-2023-49084: RCE vulnerability when managing links (boo#1218360) * CVE-2023-49085: SQL Injection vulnerability when managing poller devices (boo#1218378) * CVE-2023-49086: XSS vulnerability when adding new devices (boo#1218366) * CVE-2023-49088: XSS vulnerability when viewing data sources in debug mode (boo#1218379) * CVE-2023-51448: SQL Injection vulnerability when managing SNMP Notification Receivers (boo#1218381) * When viewing data sources, an undefined variable error may be seen * Improvements for Poller Last Run Date * Attempting to edit a Data Query that does not exist throws warnings and not an GUI error * Improve PHP 8.1 support when adding devices * Viewing Data Query Cache can cause errors to be logged * Preserve option is not properly honoured when removing devices at command line * Infinite recursion is possible during a database failure * Monitoring Host CPU's does not always work on Windows endpoints * Multi select drop down list box not rendered correctly in Chrome and Edge * Selective Plugin Debugging may not always work as intended * During upgrades, Plugins may be falsely reported as incompatible * Plugin management at command line does not work with multiple plugins * Improve PHP 8.1 support for incrementing only numbers * Allow the renaming of guest and template accounts * DS Stats issues warnings when the RRDfile has not been initialized * When upgrading, missing data source profile can cause errors to be logged * When deleting a single Data Source, purge historical debug data * Improvements to form element warnings * Some interface aliases do not appear correctly * Aggregate graph does not show other percentiles * Settings table updates for large values reverted by database repair * When obtaining graph records, error messages may be recorded * Unable to change a device's community at command line * Increase timeout for RRDChecker * When viewing a graph, option to edit template may lead to incorrect URL * When upgrading, failures may occur due to missing color table keys * On installation, allow a more appropriate template to be used as the default * When data input parameters are allowed to be null, allow null * CSV Exports may not always output data correctly * When debugging a graph, long CDEF's can cause undesirable scrolling * Secondary LDAP server not evaluated when the first one has failed * When adding a device, using the bulk walk option can make version information appear * When parsing a Data Query resource, an error can be reported if no direction is specified * Database reconnection can cause errors to be reported incorrectly * fix returned value if $sau is empty * Add Aruba switch, Aruba controller and HPE iLO templates * Add OSCX 6x00 templatesCVSSUnscored Insufficient evidenceOPENSUSE-SU-2023:0275-1opensuse · cacti-spine&distro=openSUSE Leap 15.4 +9 more3y agoopensuse cacti-spine&distro=openSUSE Leap 15.4Security update for cacti, cacti-spine This update for cacti, cacti-spine fixes the following issues: cacti-spine 1.2.25: * Spine should see if script to be executed is executable * Enhance number recognition * When polling devices, sort by larger number of items first * Log format may be corrupted when timeout occurs * Compile warning appears due to GCC flag on RHEL7/RHEL8 * Downed device detection only checks one of the two uptime OIDs * Compile error appears due to execinfo.h on FreeBSD * Bootstrap shell script contains some PHP cruft * Padding is not always removed from the start of non-numeric strings * Improve SNMP result handling for non-numeric results * Further improve SNMP result handling for non-numeric results * Remove check for the max_oids column which has been present since Cacti v1.0 * Minimize Sorting when fetching poller records for maximum performance * Spine should see if script to be executed is executable cacti-spine 1.2.24: * Fix segfault when ignoring older OIDs cacti 1.2.25: * CVE-2023-30534: Protect against Insecure deserialization of filter data (boo#1215082) * CVE-2023-39360: Cross-Site Scripting vulnerability when creating new graphs (boo#1215044) * CVE-2023-39361: Unauthenticated SQL Injection when viewing graphs (boo#1215045) * CVE-2023-39357: SQL Injection when saving data with sql_save() (boo#1215040) * CVE-2023-39362: Authenticated command injection when using SNMP options (boo#1215047) * CVE-2023-39359: Authenticated SQL injection vulnerability when managing graphs (boo#1215043) * CVE-2023-39358: Authenticated SQL injection vulnerability when managing reports (boo#1215042) * CVE-2023-39365: SQL Injection when using regular expressions (boo#1215051) * CVE-2023-39364: redirect in change password functionality (boo#1215050) * CVE-2023-39366: Cross-Site Scripting vulnerability with Device Name when managing Data Sources (boo#1215052) * CVE-2023-39510: Cross-Site Scripting vulnerability with Device Name when administrating Reports (boo#1215053) * CVE-2023-39511: Cross-Site Scripting vulnerability with Device Name when editing Graphs whilst managing Reports (boo#1215081) * CVE-2023-39512: Cross-Site Scripting vulnerability with Device Name when managing Data Sources (boo#1215054) * CVE-2023-39513: Cross-Site Scripting vulnerability with Device Name when debugging data queries (boo#1215055) * CVE-2023-39514: Cross-Site Scripting vulnerability with Data Source Name when managing Graphs (boo#1215056) * CVE-2023-39515: Cross-Site Scripting vulnerability with Data Source Name when debugging Data Queries (boo#1215058) * CVE-2023-39516: Cross-Site Scripting vulnerability with Data Source Information when managing Data Sources (boo#1215059) * When rebuilding the Poller Cache from command line, allow it to be multi-threaded * When searching tree or list views, the URL does not update after changes * When creating a Data Source Template with a specific snmp port, the port is not always applied * When a Data Query references a file, the filename should be trimmed to remove spurious spaces * THold plugin may not always install or upgrade properly * RRD file structures are not always updated properly, if there are more Data Sources in the Data Template than the Graph Template * When reindexing devices, errors may sometimes be shown * Boost may loose data when the database server is overloaded * Boost can sometimes output unexpected or invalid values * Boost should not attempt to start if there are no items to process * Rebuilding the poller cache does not always work as expected * Host CPU items may not work poll as expected when on a remote data collector where hmib is also enabled * When creating new graphs, invalid offset errors may be generated * When importing packages, SQL errors may be generated * When managing plugins from command line, the --plugin option is not properly handled * When automating an install of Cacti, error messages can be appear * When performing automated install of a plugin, warnings can be thrown * Automation references the wrong table name causing errors * Data Source Info Mode produces invalid recommendations * Data Source Debug 'Run All' generates too many log messages * The description of rebuild poller cache in utilities does not display properly * When reindexing a device, debug information may not always display properly * Upon displaying a form with errors, the session error fields variable isn't cleared * MariaDB clusters will no longer support exclusive locks * RRDtool can fail to update when sources in Data Template and Graph Template data sources do not match * Compatibility improvements for Boost under PHP 8.x * When searching the tree, increase the time before querying for items * Device Location drop down does not always populate correctly * When viewing Realtime graphs, undefined variable errors may be reported * SNMP Uptime is not always ignored for spikekills * Improve detection of downed Devices * When reporting missing functions from Plugins, ensure messages do not occur too often * When starting the Cacti daemon, database errors may be reported when there is no problem * When reporting from RRDcheck, ensure prefix is in the correct casing * Improve Orphaned Data Source options and display * Parsing the PHP Configuration may sometimes produce errors * Security processes attempt to check for a user lockout even if there is no user logged in * When attempting to edit a tree, the search filter for Graphs remains disabled * When reindexing, a Data Source that could be un-orphaned may not always be unorphaned * When parsing a date value, there could be more than 30 chars * Untemplated Data Sources can fail to update due to lack of an assigned Graph * When processing items to check, do not include disabled hosts * When saving a Data Source Template, SQL errors may be reported * When importing a Template, errors may be recorded * Some display strings have invalid formatting that cannot be parsed * When filtering with regular expressions, the 'does not match' option does not always function as expected * When enabling a plugin, sometimes it can appear as if nothing happens * Ensure the Rows Per Page option shows limitations set by configuration * Plugins are unable to modify fields in the setting 'Change Device Settings' * When reporting emails being sent, ensure BCC addresses are also included * Improve compatibility of SNMP class trim handling under PHP 8.x * When importing legacy Data Query Templates, the Template can become unusable * Provide ability to raise an event when extending the settings form * Prevent unsupported SQL Mode flags from being set * The DSStats summary does not always display expected values * When performing a fresh install, device classification may be missing. * Duplication functions for Graph/Template and Data Source/Template do not return and id * Duplication of Device Templates should be an API call * Unable to convert database to latin1 instead of utf8 if desired * When creating Graphs, the process may become slower over time as more items exist * When a bulk walk size is set to automatic, this is not always set to the optimal value * Update copyright notice on import packages * When viewing Orphan Graphs, SQL errors may be reported * When reindexing hosts from command line, ensure only one process runs at once * When a Data Query has no Graphs, it may not be deletable * When duplicating a Graph Template, provide an option to not duplicate Data Query association * When duplicating a Data Template errors can appear in the Cacti log * When importing a Package, previewing makes unexpected changes to Cacti Templates * When enabling boost on a fresh install, an error may be reported * Improve compatibility for backtrace logging under PHP 8.x * Improve compatibility for Advanced Ping under PHP 8.x * Provide new templates for Fortigate and Aruba Cluster to be available during install * Provide new template for SNMP Printer to be available during install * When importing devices, allow a device classification to be known * Extend length of maximum name in settings table * Extend length of maximum name in user settings table * Data Queries do not have a Duplication function * Upgrade d3.js v7.8.2 and billboard.js v3.7.4 * Upgrade ua-parser.js to version 1.0.35 * Update Cisco Device Template to include HSRP graph template * New hook for device template change 'device_template_change' cacti 1.2.24 * Fix: Unable to import Local Linux Machine template * Fix multiple charting and display issues * Compatibility changes for SNMP under PHP 8.2, and other PHP compatibility updates * Fix multiple issues editing settings * timeout fixes for Basic Auth * multiple data poller bug fixesCVSSUnscored Act nowCVE-2022-46169Cacti +9 more3y agoCacti Command Injection VulnerabilityCacti is an open source platform which provides a robust and extensible operational monitoring and fault management framework for users. In affected versions a command injection vulnerability allows an unauthenticated user to execute arbitrary code on a server running Cacti, if a specific data source was selected for any monitored device. The vulnerability resides in the `remote_agent.php` file. This file can be accessed without authentication. This function retrieves the IP address of the client via `get_client_addr` and resolves this IP address to the corresponding hostname via `gethostbyaddr`. After this, it is verified that an entry within the `poller` table exists, where the hostname corresponds to the resolved hostname. If such an entry was found, the function returns `true` and the client is authorized. This authorization can be bypassed due to the implementation of the `get_client_addr` function. The function is defined in the file `lib/functions.php` and checks serval `$_SERVER` variables to determine the IP address of the client. The variables beginning with `HTTP_` can be arbitrarily set by an attacker. Since there is a default entry in the `poller` table with the hostname of the server running Cacti, an attacker can bypass the authentication e.g. by providing the header `Forwarded-For: <TARGETIP>`. This way the function `get_client_addr` returns the IP address of the server running Cacti. The following call to `gethostbyaddr` will resolve this IP address to the hostname of the server, which will pass the `poller` hostname check because of the default entry. After the authorization of the `remote_agent.php` file is bypassed, an attacker can trigger different actions. One of these actions is called `polldata`. The called function `poll_for_data` retrieves a few request parameters and loads the corresponding `poller_item` entries from the database. If the `action` of a `poller_item` equals `POLLER_ACTION_SCRIPT_PHP`, the function `proc_open` is used to execute a PHP script. The attacker-controlled parameter `$poller_id` is retrieved via the function `get_nfilter_request_var`, which allows arbitrary strings. This variable is later inserted into the string passed to `proc_open`, which leads to a command injection vulnerability. By e.g. providing the `poller_id=;id` the `id` command is executed. In order to reach the vulnerable call, the attacker must provide a `host_id` and `local_data_id`, where the `action` of the corresponding `poller_item` is set to `POLLER_ACTION_SCRIPT_PHP`. Both of these ids (`host_id` and `local_data_id`) can easily be bruteforced. The only requirement is that a `poller_item` with an `POLLER_ACTION_SCRIPT_PHP` action exists. This is very likely on a productive instance because this action is added by some predefined templates like `Device - Uptime` or `Device - Polling Time`. This command injection vulnerability allows an unauthenticated user to execute arbitrary commands if a `poller_item` with the `action` type `POLLER_ACTION_SCRIPT_PHP` (`2`) is configured. The authorization bypass should be prevented by not allowing an attacker to make `get_client_addr` (file `lib/functions.php`) return an arbitrary IP address. This could be done by not honoring the `HTTP_...` `$_SERVER` variables. If these should be kept for compatibility reasons it should at least be prevented to fake the IP address of the server running Cacti. This vulnerability has been addressed in both the 1.2.x and 1.3.x release branches with `1.2.23` being the first release containing the patch.CVSS9.8CriticalKEVEPSS99.83%Insufficient evidenceOPENSUSE-SU-2022:10170-1opensuse · cacti-spine&distro=openSUSE Leap 15.3 +9 more4y agoopensuse cacti-spine&distro=openSUSE Leap 15.3Security update for cacti, cacti-spine This update for cacti, cacti-spine fixes the following issues: cacti-spine 1.2.22, delivering a number of bug fixes: * When polling time is exceed, spine does not always exit as expected * Spine logging at `-V 5` includes an extra line feed * Incorrect SNMP responses can cause spine to crash * Properly handle devices that timeout responding to the Extended Uptime * MariaDB can cause spine to abort prematurely despite error handling * Spine should log the error time when exiting via signal cacti-spine 1.2.21: * Disable DES if Net-SNMP doesn't have it cacti 1.2.22, providing one security fix, a number of bug fixes and a collection of improvements: * When creating new graphs, cross site injection is possible (boo#1203952) * When creating user from template, multiple Domain FullName and Mail are not propagated * Nectar Aggregate 95th emailed report broken * Boost may not find archive tables correctly * Users may be unable to change their password when forced during a login * Net-SNMP Memory Graph Template has Wrong GPRINT * Search in tree view unusable on larger installations * Increased bulk insert size to avoid partial inserts and potential data loss. * Call to undefined function boost_debug in Cacti log * When no guest template is set, login cookies are not properly set * Later RRDtool releases do not need to check last_update time * Regex filters are not always long enough * Domains based LDAP and AD Fullname and Email not auto-populated * Cacti polling and boost report the wrong number of Data Sources when Devices are disabled * When editing Graph Template Items there are cases where VDEF's are hidden when they should be shown * Database SSL setting lacks default value * Update default path cacti under *BSD by xmacan * Web Basic authentication not creating template user * Unable to change the Heartbeat of a Data Source Profile * Tree Search Does Not Properly Search All Trees * When structured paths are setup, RRDfiles may not always be created when possible * When parsing the logs, caching would help speed up processing * Deprecation warnings when attempting real-time Graphs with PHP8.1 * Custom Timespan is lost when clicking other tree branches * Non device based Data Sources not being polled * When Resource XML file inproperly formatted, graph creation can fail with errors * Update code style to support PHP 8 requirements * None' shows all graphs * Realtime popup window experiences issues on some browsers * Auth settings do not always properly reflect the options selected by ddb4github * MySQL can cause cacti to become stalled due to locking issues * Boost process can get hung under rare conditions until the poller times out * Exporting graphs under PHP 8 can cause errors * Host table has wrong default for disabled and deleted columns * RRD storage paths do not scale properly * When importing, make it possible to only import certain components * Update change_device script to include new features by bmfmancini * Make help pages use latest online version wherever possible * Cacti should show PHP INI locations during install * Detect PHP INI values that are different in the INI vs running config * Added Gradient Color support for AREA charts by thurban * Update CDEF functions for RRDtool * When boost is running, it's not clear which processes are running and how long they have to complete cacti 1.2.21: * Add a CLI script to install/enable/disable/uninstall plugins * Add log message when purging DS stats and poller repopulate * A collection of bug fixesCVSSUnscored PrioritiseCVE-2022-0730cacti +12 more4y agocacti cactiUnder certain ldap conditions, Cacti authentication can be bypassed with certain credential types.CVSS9.8CriticalEPSS3.50%