CVE-2020-8813
Fixed in a distro release EPSS 74%
graph_realtime.php in Cacti 1.2.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in a cookie, if a guest user has the graph real-time privilege.
Products: cacti, fedoraproject fedora, opmantek open-audit, opensuse suse_package_hub, debian_linux
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 10 | cacti | 1.2.2+ds1-2+deb10u5 |
| Debian 12 | cacti | 1.2.10+ds1-1 |
| Debian 13 | cacti | 1.2.10+ds1-1 |
| Debian 14 | cacti | 1.2.10+ds1-1 |
| SUSE Package Hub 12 | cacti | 1.2.11-5.1 |
| SUSE Package Hub 12 | cacti-spine | 1.2.11-2.1 |
| SUSE Package Hub 15 SP1 | cacti | 1.2.11-bp151.4.6.1 |
| SUSE Package Hub 15 SP1 | cacti-spine | 1.2.11-bp151.4.6.1 |
| Ubuntu Pro 14.04 LTS | cacti | no fix |
| Ubuntu Pro 18.04 LTS | cacti | no fix |
| openSUSE Leap 15.1 | cacti | 1.2.11-5.1 |
| openSUSE Leap 15.1 | cacti-spine | 1.2.11-2.1 |
| openSUSE Tumbleweed | cacti | 1.2.18-1.2 |