{"schemaVersion":3,"id":"OPENSUSE-SU-2024:0031-1","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Security update for cacti, cacti-spine\n\nThis update for cacti, cacti-spine fixes the following issues:\n\ncacti-spine 1.2.26:\n\n* Fix: Errors when uptime OID is not present\n* Fix: MySQL reconnect option is depreciated\n* Fix: Spine does not check a host with no poller items\n* Fix: Poller may report the wrong number of devices polled\n* Feature: Allow users to override the threads setting at the command line\n* Feature: Allow spine to run in ping-only mode\n\ncacti 1.2.26:\n\n* CVE-2023-50250: XSS vulnerability when importing a template file (boo#1218380)\n* CVE-2023-49084: RCE vulnerability when managing links (boo#1218360)\n* CVE-2023-49085: SQL Injection vulnerability when managing poller devices (boo#1218378)\n* CVE-2023-49086: XSS vulnerability when adding new devices (boo#1218366)\n* CVE-2023-49088: XSS vulnerability when viewing data sources in debug mode (boo#1218379)\n* CVE-2023-51448: SQL Injection vulnerability when managing SNMP Notification Receivers (boo#1218381)\n* When viewing data sources, an undefined variable error may be seen\n* Improvements for Poller Last Run Date\n* Attempting to edit a Data Query that does not exist throws warnings and not an GUI error\n* Improve PHP 8.1 support when adding devices\n* Viewing Data Query Cache can cause errors to be logged\n* Preserve option is not properly honoured when removing devices at command line\n* Infinite recursion is possible during a database failure\n* Monitoring Host CPU's does not always work on Windows endpoints\n* Multi select drop down list box not rendered correctly in Chrome and Edge\n* Selective Plugin Debugging may not always work as intended\n* During upgrades, Plugins may be falsely reported as incompatible\n* Plugin management at command line does not work with multiple plugins\n* Improve PHP 8.1 support for incrementing only numbers\n* Allow the renaming of guest and template accounts\n* DS Stats issues warnings when the RRDfile has not been initialized\n* When upgrading, missing data source profile can cause errors to be logged\n* When deleting a single Data Source, purge historical debug data\n* Improvements to form element warnings\n* Some interface aliases do not appear correctly\n* Aggregate graph does not show other percentiles\n* Settings table updates for large values reverted by database repair\n* When obtaining graph records, error messages may be recorded\n* Unable to change a device's community at command line\n* Increase timeout for RRDChecker\n* When viewing a graph, option to edit template may lead to incorrect URL\n* When upgrading, failures may occur due to missing color table keys\n* On installation, allow a more appropriate template to be used as the default\n* When data input parameters are allowed to be null, allow null\n* CSV Exports may not always output data correctly\n* When debugging a graph, long CDEF's can cause undesirable scrolling\n* Secondary LDAP server not evaluated when the first one has failed\n* When adding a device, using the bulk walk option can make version information appear\n* When parsing a Data Query resource, an error can be reported if no direction is specified\n* Database reconnection can cause errors to be reported incorrectly\n* fix returned value if $sau is empty\n* Add Aruba switch, Aruba controller and HPE iLO templates\n* Add OSCX 6x00 templates","dates":{"published":"2024-01-24T12:47:05.000Z","modified":"2026-02-04T02:28:19.679Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":null,"severity":"unknown","version":null,"versionLabel":null,"source":null,"vector":null,"computed":false,"selection":"none"},"metrics":[]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"opensuse","product":"cacti-spine&distro=openSUSE Leap 15.5","name":"cacti-spine","label":"cacti-spine&distro=openSUSE Leap 15.5","ecosystem":"openSUSE","cpePart":null,"purl":"pkg:rpm/opensuse/cacti-spine&distro=openSUSE Leap 15.5","purlType":"rpm","versions":[{"text":"< 1.2.26-bp155.2.6.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.2.26-bp155.2.6.1","eol":null,"hubHref":null},{"vendor":"opensuse","product":"cacti&distro=openSUSE Leap 15.5","name":"cacti","label":"cacti&distro=openSUSE Leap 15.5","ecosystem":"openSUSE","cpePart":null,"purl":"pkg:rpm/opensuse/cacti&distro=openSUSE Leap 15.5","purlType":"rpm","versions":[{"text":"< 1.2.26-bp155.2.6.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.2.26-bp155.2.6.1","eol":null,"hubHref":null},{"vendor":"suse","product":"cacti-spine&distro=SUSE Package Hub 12","name":"cacti-spine","label":"cacti-spine&distro=SUSE Package Hub 12","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/cacti-spine&distro=SUSE Package Hub 12","purlType":"rpm","versions":[{"text":"< 1.2.26-bp155.2.6.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.2.26-bp155.2.6.1","eol":null,"hubHref":null},{"vendor":"suse","product":"cacti-spine&distro=SUSE Package Hub 15 SP5","name":"cacti-spine","label":"cacti-spine&distro=SUSE Package Hub 15 SP5","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/cacti-spine&distro=SUSE Package Hub 15 SP5","purlType":"rpm","versions":[{"text":"< 1.2.26-bp155.2.6.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.2.26-bp155.2.6.1","eol":null,"hubHref":null},{"vendor":"suse","product":"cacti&distro=SUSE Package Hub 12","name":"cacti","label":"cacti&distro=SUSE Package Hub 12","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/cacti&distro=SUSE Package Hub 12","purlType":"rpm","versions":[{"text":"< 1.2.26-bp155.2.6.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.2.26-bp155.2.6.1","eol":null,"hubHref":null},{"vendor":"suse","product":"cacti&distro=SUSE Package Hub 15 SP5","name":"cacti","label":"cacti&distro=SUSE Package Hub 15 SP5","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/cacti&distro=SUSE Package Hub 15 SP5","purlType":"rpm","versions":[{"text":"< 1.2.26-bp155.2.6.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.2.26-bp155.2.6.1","eol":null,"hubHref":null}],"affectedCount":6,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/IZJKJNYP7JFJ3XMRIGZT22J5DIAVPSY7/","label":"lists.opensuse.org/archives/…","hostname":"lists.opensuse.org","tags":["Advisory"]},{"url":"https://bugzilla.suse.com/1218360","label":"bugzilla.suse.com/1218360","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1218366","label":"bugzilla.suse.com/1218366","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1218378","label":"bugzilla.suse.com/1218378","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1218379","label":"bugzilla.suse.com/1218379","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1218380","label":"bugzilla.suse.com/1218380","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1218381","label":"bugzilla.suse.com/1218381","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://www.suse.com/security/cve/CVE-2023-49084","label":"www.suse.com/security/cve/CVE-2023-49084","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2023-49085","label":"www.suse.com/security/cve/CVE-2023-49085","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2023-49086","label":"www.suse.com/security/cve/CVE-2023-49086","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2023-49088","label":"www.suse.com/security/cve/CVE-2023-49088","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2023-50250","label":"www.suse.com/security/cve/CVE-2023-50250","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2023-51448","label":"www.suse.com/security/cve/CVE-2023-51448","hostname":"www.suse.com","tags":["WEB"]}],"lineage":{"upstream":["CVE-2023-49084","CVE-2023-49085","CVE-2023-49086","CVE-2023-49088","CVE-2023-50250","CVE-2023-51448"],"downstream":[],"duplicates":[],"related":["CVE-2023-49084","CVE-2023-49085","CVE-2023-49086","CVE-2023-49088","CVE-2023-50250","CVE-2023-51448"]},"timeline":[{"kind":"published","date":"2024-01-24T12:47:05.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-02-04T02:28:19.679Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":0,"level":"minimal","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-22T09:45:59.953Z","stale":false,"partial":false}}