Cacti 1.2.8 has stored XSS in data_sources.php, color_templates_item.php, graphs.php, graph_items.php, lib/api_automation.php, user_admin.php, and user_group_admin.php, as demonstrated by the description parameter in data_sources.php (a raw string from the database that is displayed by $header to trigger the XSS).

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Cacti 1.2.8 has stored XSS in data_sources.php, color_templates_item.php, graphs.php, graph_items.php,     lib/api_automation.php, user_admin.php, and user_group_admin.php, as demonstrated by the description     parameter in data_sources.php (a raw string from the database that is displayed by $header to trigger the     XSS). (CVE-2020-7106)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Debian 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-2965 advisory.

    Multiple vulnerabilities were discovered in Cacti, a web interface for graphing of monitoring systems,     leading to authentication bypass and cross-site scripting (XSS). An attacker may get access to     unauthorized areas and impersonate other users, under certain conditions. CVE-2018-10060 Cacti has XSS     because it does not properly reject unintended characters, related to use of the sanitize_uri function in     lib/functions.php. CVE-2018-10061 Cacti has XSS because it makes certain htmlspecialchars calls without     the ENT_QUOTES flag (these calls occur when the html_escape function in lib/html.php is not used).
    CVE-2019-11025 No escaping occurs before printing out the value of the SNMP community string (SNMP     Options) in the View poller cache, leading to XSS. CVE-2020-7106 Cacti has stored XSS in multiple files as     demonstrated by the description parameter in data_sources.php (a raw string from the database that is     displayed by $header to trigger the XSS). CVE-2020-13230 Disabling a user account does not immediately     invalidate any permissions granted to that account (e.g., permission to view logs). CVE-2020-23226     Multiple Cross Site Scripting (XSS) vulnerabilities exist in multiple files. CVE-2021-23225 Cacti allows     authenticated users with User Management permissions to inject arbitrary web script or HTML in the     new_username field during creation of a new user via Copy method at user_admin.php. CVE-2022-0730 Under     certain ldap conditions, Cacti authentication can be bypassed with certain credential types. For Debian 9     stretch, these problems have been fixed in version 0.8.8h+ds1-10+deb9u2. We recommend that you upgrade     your cacti packages. For the detailed security status of cacti please refer to its security tracker page     at: https://security-tracker.debian.org/tracker/cacti Further information about Debian LTS security     advisories, how to apply these updates to your system and frequently asked questions can be found at:
    https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for cacti, cacti-spine fixes the following issues :

cacti-spine and cacti were updated to 1.2.12 :

cacti fixes :

  - CVE-2020-7106: Lack of escaping of color items can lead     to XSS exposure (boo#1163749)

  - Fix multiple graphing bugs and web UI issues

  - Fix multiple warnings, PHP Exceptions and errors

  - Content-Security-Policy prevents External Links from     being opened

  - Prevent runtime memory issues by increasing memory limit

  - Improve SNMPv3 handling

cacti-spine fixes :

  - Failed host lookup causes spine to crash

Cacti developer reports :

Lack of escaping of color items can lead to XSS exposure.

This update for cacti, cacti-spine to version 1.2.11 fixes the following issues :

This update is fixing multiple vulnerabilities and adding bug fixes.
For more details consult the changes file.

The Cacti developers reports :

When guest users have access to realtime graphs, remote code could be executed (CVE-2020-8813).

Lack of escaping on some pages can lead to XSS exposure (CVE-2020-7106).

Remote Code Execution due to input validation failure in Performance Boost Debug Log (CVE-2020-7237).

The remote host is affected by the vulnerability described in GLSA-202003-40 (Cacti: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Cacti. Please review       the CVE identifiers referenced below for details.
  Impact :

    Remote attackers could execute arbitrary code or bypass intended access       restrictions.
  Workaround :

    There is no known workaround at this time.

This update for cacti, cacti-spine fixes the following issues :

cacti-spine was updated to version 1.2.9.

Security issues fixed :

  - CVE-2009-4112: Fixed a privilege escalation     (bsc#1122535).

  - CVE-2018-20723: Fixed a cross-site scripting (XSS)     vulnerability (bsc#1122245).

  - CVE-2018-20724: Fixed a cross-site scripting (XSS)     vulnerability (bsc#1122244).

  - CVE-2018-20725: Fixed a privilege escalation that could     occur under certain conditions (bsc#1122535).

  - CVE-2018-20726: Fixed a cross-site scripting (XSS)     vulnerability (bsc#1122242).

  - CVE-2019-16723: Fixed an authentication bypass     vulnerability.

  - CVE-2019-17357: Fixed a SQL injection vulnerability     (bsc#1158990).

  - CVE-2019-17358: Fixed an unsafe deserialization in     sanitize_unserialize_selected_items (bsc#1158992).

  - CVE-2020-7106: Fixed a potential cross-site scripting     (XSS) vulnerability (bsc#1163749).

  - CVE-2020-7237: Fixed a remote code execution that     affected privileged users via shell metacharacters in     the Performance Boost Debug Log field (bsc#1161297).

Non-security issues fixed :

  - Fixed missing packages php-json, php-ctype, and php-gd     in cacti.spec (boo#1101024).

  - Fixed Apache2.4 and Apache2.2 runtime configuration     issue (boo#1101139).

- Update to 1.2.9

  - CVE-2020-7106, CVE-2020-7237

Release notes: https://www.cacti.net/release_notes.php?version=1.2.9

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that there were a number of cross-site scripting vulnerabilities in cacti, a web interface for monitoring systems.

For Debian 8 'Jessie', this issue has been fixed in cacti version 0.8.8b+dfsg-8+deb8u9.

We recommend that you upgrade your cacti packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
255730	Linux Distros Unpatched Vulnerability : CVE-2020-7106	Nessus	Misc.	medium
159321	Debian DLA-2965-1 : cacti - LTS security update	Nessus	Debian Local Security Checks	critical
136492	openSUSE Security Update : cacti / cacti-spine (openSUSE-2020-654)	Nessus	SuSE Local Security Checks	medium
136386	FreeBSD : cacti -- XSS exposure (cd864f1a-8e5a-11ea-b5b4-641c67a117d8)	Nessus	FreeBSD Local Security Checks	medium
136073	openSUSE Security Update : cacti / cacti-spine (openSUSE-2020-558)	Nessus	SuSE Local Security Checks	high
135111	FreeBSD : cacti -- multiple vulnerabilities (e2b564fc-7462-11ea-af63-38d547003487)	Nessus	FreeBSD Local Security Checks	high
134726	GLSA-202003-40 : Cacti: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
134195	openSUSE Security Update : cacti / cacti-spine (openSUSE-2020-272)	Nessus	SuSE Local Security Checks	high
133779	Fedora 31 : cacti / cacti-spine (2020-90f1c8229e)	Nessus	Fedora Local Security Checks	high
133775	Fedora 30 : cacti / cacti-spine (2020-0fc6dd0fd2)	Nessus	Fedora Local Security Checks	high
133102	Debian DLA-2069-1 : cacti security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2020-7106

medium

Tenable Plugins

medium

critical

medium

medium

high

high

high

high

high

high

medium