CVE-2020-14295
Fixed in a distro release EPSS 86%
A SQL injection issue in color.php in Cacti 1.2.12 allows an admin to inject SQL via the filter parameter. This can lead to remote command execution because the product accepts stacked queries.
Products: cacti, fedoraproject fedora
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | cacti | 1.2.13+ds1-1 |
| Debian 13 | cacti | 1.2.13+ds1-1 |
| Debian 14 | cacti | 1.2.13+ds1-1 |
| SUSE Package Hub 12 | cacti | 1.2.13-11.1 |
| SUSE Package Hub 12 | cacti-spine | 1.2.13-8.1 |
| SUSE Package Hub 15 SP1 | cacti | 1.2.13-bp151.4.12.1 |
| SUSE Package Hub 15 SP1 | cacti-spine | 1.2.13-bp151.4.12.1 |
| Ubuntu Pro 14.04 LTS | cacti | no fix |
| Ubuntu Pro 16.04 LTS | cacti | 0.8.8f+ds1-4ubuntu4.16.04.2+esm1 |
| Ubuntu Pro 18.04 LTS | cacti | 1.1.38+ds1-1ubuntu0.1~esm1 |
| Ubuntu Pro 20.04 LTS | cacti | 1.2.10+ds1-1ubuntu1+esm1 |
| openSUSE Leap 15.1 | cacti | 1.2.13-11.1 |
| openSUSE Leap 15.1 | cacti-spine | 1.2.13-8.1 |
| openSUSE Leap 15.2 | cacti | 1.2.13-11.1 |
| openSUSE Leap 15.2 | cacti-spine | 1.2.13-8.1 |
| openSUSE Tumbleweed | cacti | 1.2.18-1.2 |