{"schemaVersion":3,"id":"OPENSUSE-SU-2023:0275-1","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Security update for cacti, cacti-spine\n\nThis update for cacti, cacti-spine fixes the following issues:\n\ncacti-spine 1.2.25:\n\n* Spine should see if script to be executed is executable\n* Enhance number recognition\n* When polling devices, sort by larger number of items first\n* Log format may be corrupted when timeout occurs\n* Compile warning appears due to GCC flag on RHEL7/RHEL8\n* Downed device detection only checks one of the two uptime OIDs\n* Compile error appears due to execinfo.h on FreeBSD\n* Bootstrap shell script contains some PHP cruft\n* Padding is not always removed from the start of non-numeric strings\n* Improve SNMP result handling for non-numeric results\n* Further improve SNMP result handling for non-numeric results\n* Remove check for the max_oids column which has been present since Cacti v1.0\n* Minimize Sorting when fetching poller records for maximum performance\n* Spine should see if script to be executed is executable\n\ncacti-spine 1.2.24:\n\n* Fix segfault when ignoring older OIDs\n\ncacti 1.2.25:\n\n* CVE-2023-30534: Protect against Insecure deserialization of filter data (boo#1215082)\n* CVE-2023-39360: Cross-Site Scripting vulnerability when creating new graphs (boo#1215044)\n* CVE-2023-39361: Unauthenticated SQL Injection when viewing graphs (boo#1215045)\n* CVE-2023-39357: SQL Injection when saving data with sql_save() (boo#1215040)\n* CVE-2023-39362: Authenticated command injection when using SNMP options (boo#1215047)\n* CVE-2023-39359: Authenticated SQL injection vulnerability when managing graphs (boo#1215043)\n* CVE-2023-39358: Authenticated SQL injection vulnerability when managing reports (boo#1215042)\n* CVE-2023-39365: SQL Injection when using regular expressions (boo#1215051)\n* CVE-2023-39364: redirect in change password functionality (boo#1215050)\n* CVE-2023-39366: Cross-Site Scripting vulnerability with Device Name when managing Data Sources (boo#1215052)\n* CVE-2023-39510: Cross-Site Scripting vulnerability with Device Name when administrating Reports (boo#1215053)\n* CVE-2023-39511: Cross-Site Scripting vulnerability with Device Name when editing Graphs whilst managing Reports (boo#1215081)\n* CVE-2023-39512: Cross-Site Scripting vulnerability with Device Name when managing Data Sources (boo#1215054)\n* CVE-2023-39513: Cross-Site Scripting vulnerability with Device Name when debugging data queries (boo#1215055)\n* CVE-2023-39514: Cross-Site Scripting vulnerability with Data Source Name when managing Graphs (boo#1215056)\n* CVE-2023-39515: Cross-Site Scripting vulnerability with Data Source Name when debugging Data Queries (boo#1215058)\n* CVE-2023-39516: Cross-Site Scripting vulnerability with Data Source Information when managing Data Sources (boo#1215059)\n* When rebuilding the Poller Cache from command line, allow it to be multi-threaded\n* When searching tree or list views, the URL does not update after changes\n* When creating a Data Source Template with a specific snmp port, the port is not always applied\n* When a Data Query references a file, the filename should be trimmed to remove spurious spaces\n* THold plugin may not always install or upgrade properly\n* RRD file structures are not always updated properly, if there are more Data Sources in the Data Template than the Graph Template\n* When reindexing devices, errors may sometimes be shown\n* Boost may loose data when the database server is overloaded\n* Boost can sometimes output unexpected or invalid values\n* Boost should not attempt to start if there are no items to process\n* Rebuilding the poller cache does not always work as expected\n* Host CPU items may not work poll as expected when on a remote data collector where hmib is also enabled\n* When creating new graphs, invalid offset errors may be generated\n* When importing packages, SQL errors may be generated\n* When managing plugins from command line, the --plugin option is not properly handled\n* When automating an install of Cacti, error messages can be appear\n* When performing automated install of a plugin, warnings can be thrown\n* Automation references the wrong table name causing errors\n* Data Source Info Mode produces invalid recommendations\n* Data Source Debug 'Run All' generates too many log messages\n* The description of rebuild poller cache in utilities does not display properly\n* When reindexing a device, debug information may not always display properly\n* Upon displaying a form with errors, the session error fields variable isn't cleared\n* MariaDB clusters will no longer support exclusive locks\n* RRDtool can fail to update when sources in Data Template and Graph Template data sources do not match\n* Compatibility improvements for Boost under PHP 8.x\n* When searching the tree, increase the time before querying for items\n* Device Location drop down does not always populate correctly\n* When viewing Realtime graphs, undefined variable errors may be reported\n* SNMP Uptime is not always ignored for spikekills\n* Improve detection of downed Devices\n* When reporting missing functions from Plugins, ensure messages do not occur too often\n* When starting the Cacti daemon, database errors may be reported when there is no problem\n* When reporting from RRDcheck, ensure prefix is in the correct casing\n* Improve Orphaned Data Source options and display\n* Parsing the PHP Configuration may sometimes produce errors\n* Security processes attempt to check for a user lockout even if there is no user logged in\n* When attempting to edit a tree, the search filter for Graphs remains disabled\n* When reindexing, a Data Source that could be un-orphaned may not always be unorphaned\n* When parsing a date value, there could be more than 30 chars\n* Untemplated Data Sources can fail to update due to lack of an assigned Graph\n* When processing items to check, do not include disabled hosts\n* When saving a Data Source Template, SQL errors may be reported\n* When importing a Template, errors may be recorded\n* Some display strings have invalid formatting that cannot be parsed\n* When filtering with regular expressions, the 'does not match' option does not always function as expected\n* When enabling a plugin, sometimes it can appear as if nothing happens\n* Ensure the Rows Per Page option shows limitations set by configuration\n* Plugins are unable to modify fields in the setting 'Change Device Settings'\n* When reporting emails being sent, ensure BCC addresses are also included\n* Improve compatibility of SNMP class trim handling under PHP 8.x\n* When importing legacy Data Query Templates, the Template can become unusable\n* Provide ability to raise an event when extending the settings form\n* Prevent unsupported SQL Mode flags from being set\n* The DSStats summary does not always display expected values\n* When performing a fresh install, device classification may be missing.\n* Duplication functions for Graph/Template and Data Source/Template do not return and id\n* Duplication of Device Templates should be an API call\n* Unable to convert database to latin1 instead of utf8 if desired\n* When creating Graphs, the process may become slower over time as more items exist\n* When a bulk walk size is set to automatic, this is not always set to the optimal value\n* Update copyright notice on import packages\n* When viewing Orphan Graphs, SQL errors may be reported\n* When reindexing hosts from command line, ensure only one process runs at once\n* When a Data Query has no Graphs, it may not be deletable\n* When duplicating a Graph Template, provide an option to not duplicate Data Query association\n* When duplicating a Data Template errors can appear in the Cacti log\n* When importing a Package, previewing makes unexpected changes to Cacti Templates\n* When enabling boost on a fresh install, an error may be reported\n* Improve compatibility for backtrace logging under PHP 8.x\n* Improve compatibility for Advanced Ping under PHP 8.x\n* Provide new templates for Fortigate and Aruba Cluster to be available during install\n* Provide new template for SNMP Printer to be available during install\n* When importing devices, allow a device classification to be known\n* Extend length of maximum name in settings table\n* Extend length of maximum name in user settings table\n* Data Queries do not have a Duplication function\n* Upgrade d3.js v7.8.2 and billboard.js v3.7.4\n* Upgrade ua-parser.js to version 1.0.35\n* Update Cisco Device Template to include HSRP graph template\n* New hook for device template change 'device_template_change'\n\ncacti 1.2.24\n\n* Fix: Unable to import Local Linux Machine template\n* Fix multiple charting and display issues\n* Compatibility changes for SNMP under PHP 8.2, and other PHP\n  compatibility updates\n* Fix multiple issues editing settings\n* timeout fixes for Basic Auth\n* multiple data poller bug fixes","dates":{"published":"2023-09-26T13:31:33.000Z","modified":"2026-02-04T02:59:17.011Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":null,"severity":"unknown","version":null,"versionLabel":null,"source":null,"vector":null,"computed":false,"selection":"none"},"metrics":[]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"opensuse","product":"cacti-spine&distro=openSUSE Leap 15.4","name":"cacti-spine","label":"cacti-spine&distro=openSUSE Leap 15.4","ecosystem":"openSUSE","cpePart":null,"purl":"pkg:rpm/opensuse/cacti-spine&distro=openSUSE Leap 15.4","purlType":"rpm","versions":[{"text":"< 1.2.25-bp155.2.3.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.2.25-bp155.2.3.1","eol":null,"hubHref":null},{"vendor":"opensuse","product":"cacti-spine&distro=openSUSE Leap 15.5","name":"cacti-spine","label":"cacti-spine&distro=openSUSE Leap 15.5","ecosystem":"openSUSE","cpePart":null,"purl":"pkg:rpm/opensuse/cacti-spine&distro=openSUSE Leap 15.5","purlType":"rpm","versions":[{"text":"< 1.2.25-bp155.2.3.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.2.25-bp155.2.3.1","eol":null,"hubHref":null},{"vendor":"opensuse","product":"cacti&distro=openSUSE Leap 15.4","name":"cacti","label":"cacti&distro=openSUSE Leap 15.4","ecosystem":"openSUSE","cpePart":null,"purl":"pkg:rpm/opensuse/cacti&distro=openSUSE Leap 15.4","purlType":"rpm","versions":[{"text":"< 1.2.25-bp155.2.3.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.2.25-bp155.2.3.1","eol":null,"hubHref":null},{"vendor":"opensuse","product":"cacti&distro=openSUSE Leap 15.5","name":"cacti","label":"cacti&distro=openSUSE Leap 15.5","ecosystem":"openSUSE","cpePart":null,"purl":"pkg:rpm/opensuse/cacti&distro=openSUSE Leap 15.5","purlType":"rpm","versions":[{"text":"< 1.2.25-bp155.2.3.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.2.25-bp155.2.3.1","eol":null,"hubHref":null},{"vendor":"suse","product":"cacti-spine&distro=SUSE Package Hub 12","name":"cacti-spine","label":"cacti-spine&distro=SUSE Package Hub 12","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/cacti-spine&distro=SUSE Package Hub 12","purlType":"rpm","versions":[{"text":"< 1.2.25-bp155.2.3.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.2.25-bp155.2.3.1","eol":null,"hubHref":null},{"vendor":"suse","product":"cacti-spine&distro=SUSE Package Hub 15 SP4","name":"cacti-spine","label":"cacti-spine&distro=SUSE Package Hub 15 SP4","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/cacti-spine&distro=SUSE Package Hub 15 SP4","purlType":"rpm","versions":[{"text":"< 1.2.25-bp155.2.3.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.2.25-bp155.2.3.1","eol":null,"hubHref":null},{"vendor":"suse","product":"cacti-spine&distro=SUSE Package Hub 15 SP5","name":"cacti-spine","label":"cacti-spine&distro=SUSE Package Hub 15 SP5","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/cacti-spine&distro=SUSE Package Hub 15 SP5","purlType":"rpm","versions":[{"text":"< 1.2.25-bp155.2.3.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.2.25-bp155.2.3.1","eol":null,"hubHref":null},{"vendor":"suse","product":"cacti&distro=SUSE Package Hub 12","name":"cacti","label":"cacti&distro=SUSE Package Hub 12","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/cacti&distro=SUSE Package Hub 12","purlType":"rpm","versions":[{"text":"< 1.2.25-bp155.2.3.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.2.25-bp155.2.3.1","eol":null,"hubHref":null},{"vendor":"suse","product":"cacti&distro=SUSE Package Hub 15 SP4","name":"cacti","label":"cacti&distro=SUSE Package Hub 15 SP4","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/cacti&distro=SUSE Package Hub 15 SP4","purlType":"rpm","versions":[{"text":"< 1.2.25-bp155.2.3.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.2.25-bp155.2.3.1","eol":null,"hubHref":null},{"vendor":"suse","product":"cacti&distro=SUSE Package Hub 15 SP5","name":"cacti","label":"cacti&distro=SUSE Package Hub 15 SP5","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/cacti&distro=SUSE Package Hub 15 SP5","purlType":"rpm","versions":[{"text":"< 1.2.25-bp155.2.3.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.2.25-bp155.2.3.1","eol":null,"hubHref":null}],"affectedCount":10,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/JFJCU2NOOFCO7XJZOUW2BQ6HWJMHSYSN/","label":"lists.opensuse.org/archives/…","hostname":"lists.opensuse.org","tags":["Advisory"]},{"url":"https://bugzilla.suse.com/1215040","label":"bugzilla.suse.com/1215040","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1215042","label":"bugzilla.suse.com/1215042","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1215043","label":"bugzilla.suse.com/1215043","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1215044","label":"bugzilla.suse.com/1215044","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1215045","label":"bugzilla.suse.com/1215045","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1215047","label":"bugzilla.suse.com/1215047","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1215050","label":"bugzilla.suse.com/1215050","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1215051","label":"bugzilla.suse.com/1215051","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1215052","label":"bugzilla.suse.com/1215052","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1215053","label":"bugzilla.suse.com/1215053","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1215054","label":"bugzilla.suse.com/1215054","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1215055","label":"bugzilla.suse.com/1215055","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1215056","label":"bugzilla.suse.com/1215056","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1215058","label":"bugzilla.suse.com/1215058","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1215059","label":"bugzilla.suse.com/1215059","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1215081","label":"bugzilla.suse.com/1215081","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1215082","label":"bugzilla.suse.com/1215082","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://www.suse.com/security/cve/CVE-2023-30534","label":"www.suse.com/security/cve/CVE-2023-30534","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2023-39357","label":"www.suse.com/security/cve/CVE-2023-39357","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2023-39358","label":"www.suse.com/security/cve/CVE-2023-39358","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2023-39359","label":"www.suse.com/security/cve/CVE-2023-39359","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2023-39360","label":"www.suse.com/security/cve/CVE-2023-39360","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2023-39361","label":"www.suse.com/security/cve/CVE-2023-39361","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2023-39362","label":"www.suse.com/security/cve/CVE-2023-39362","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2023-39364","label":"www.suse.com/security/cve/CVE-2023-39364","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2023-39365","label":"www.suse.com/security/cve/CVE-2023-39365","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2023-39366","label":"www.suse.com/security/cve/CVE-2023-39366","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2023-39510","label":"www.suse.com/security/cve/CVE-2023-39510","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2023-39511","label":"www.suse.com/security/cve/CVE-2023-39511","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2023-39512","label":"www.suse.com/security/cve/CVE-2023-39512","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2023-39513","label":"www.suse.com/security/cve/CVE-2023-39513","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2023-39514","label":"www.suse.com/security/cve/CVE-2023-39514","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2023-39515","label":"www.suse.com/security/cve/CVE-2023-39515","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2023-39516","label":"www.suse.com/security/cve/CVE-2023-39516","hostname":"www.suse.com","tags":["WEB"]}],"lineage":{"upstream":["CVE-2023-30534","CVE-2023-39357","CVE-2023-39358","CVE-2023-39359","CVE-2023-39360","CVE-2023-39361","CVE-2023-39362","CVE-2023-39364","CVE-2023-39365","CVE-2023-39366","CVE-2023-39510","CVE-2023-39511","CVE-2023-39512","CVE-2023-39513","CVE-2023-39514","CVE-2023-39515","CVE-2023-39516"],"downstream":[],"duplicates":[],"related":["CVE-2023-30534","CVE-2023-39357","CVE-2023-39358","CVE-2023-39359","CVE-2023-39360","CVE-2023-39361","CVE-2023-39362","CVE-2023-39364","CVE-2023-39365","CVE-2023-39366","CVE-2023-39510","CVE-2023-39511","CVE-2023-39512","CVE-2023-39513","CVE-2023-39514","CVE-2023-39515","CVE-2023-39516"]},"timeline":[{"kind":"published","date":"2023-09-26T13:31:33.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-02-04T02:59:17.011Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":0,"level":"minimal","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-22T08:05:32.734Z","stale":false,"partial":false}}