Alpine: multiple cacti packages: security update to 1.2.27-r0

critical Tenable Cloud Security Plugin ID 408401

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

- Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, Cacti
calls `compat_password_hash` when users set their password. `compat_password_hash` use `password_hash` if
there is it, else use `md5`. When verifying password, it calls `compat_password_verify`. In
`compat_password_verify`, `password_verify` is called if there is it, else use `md5`. `password_verify`
and `password_hash` are supported on PHP < 5.5.0, following PHP manual. The vulnerability is in
`compat_password_verify`. Md5-hashed user input is compared with correct password in database by `$md5 ==
$hash`. It is a loose comparison, not `===`. It is a type juggling vulnerability. Version 1.2.27 contains
a patch for the issue. (CVE-2024-34340)

- Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, an
arbitrary file write vulnerability, exploitable through the "Package Import" feature, allows authenticated
users having the "Import Templates" permission to execute arbitrary PHP code on the web server. The
vulnerability is located within the `import_package()` function defined into the `/lib/import.php` script.
The function blindly trusts the filename and file content provided within the XML data, and writes such
files into the Cacti base path (or even outside, since path traversal sequences are not filtered). This
can be exploited to write or overwrite arbitrary files on the web server, leading to execution of
arbitrary PHP code or other security impacts. Version 1.2.27 contains a patch for this issue.
(CVE-2024-25641)

- Cacti provides an operational monitoring and fault management framework. Versions of Cacti prior to 1.2.27
contain a residual cross-site scripting vulnerability caused by an incomplete fix for CVE-2023-50250.
`raise_message_javascript` from `lib/functions.php` now uses purify.js to fix CVE-2023-50250 (among
others). However, it still generates the code out of unescaped PHP variables `$title` and `$header`. If
those variables contain single quotes, they can be used to inject JavaScript code. An attacker exploiting
this vulnerability could execute actions on behalf of other users. This ability to impersonate users could
lead to unauthorized changes to settings. Version 1.2.27 fixes this issue. (CVE-2024-29894)

- Cacti provides an operational monitoring and fault management framework. Prior to 1.2.27, some of the data
stored in `form_save()` function in `data_queries.php` is not thoroughly checked and is used to
concatenate the HTML statement in `grow_right_pane_tree()` function from `lib/html.php` , finally
resulting in cross-site scripting. Version 1.2.27 contains a patch for the issue. (CVE-2024-31443)

- Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, some of
the data stored in `automation_tree_rules_form_save()` function in `automation_tree_rules.php` is not
thoroughly checked and is used to concatenate the HTML statement in `form_confirm()` function from
`lib/html.php` , finally resulting in cross-site scripting. Version 1.2.27 contains a patch for the issue.
(CVE-2024-31444)

Plugin Details

Severity: Critical

ID: 408401

Version: Revision 1.19

Type: Local

Family: Alpine Linux Local Security Checks

Published: 5/18/2024

Updated: 7/2/2026

Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: High

Score: 7.9

Percentile: 99.36

CVSS v2

Risk Factor: High

Base Score: 9.4

Temporal Score: 7.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:N

CVSS Score Source: CVE-2024-34340

CVSS v3

Risk Factor: Critical

Base Score: 9.1

Temporal Score: 8.4

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Vulnerability Publication Date: 5/13/2024

Exploitable With

Metasploit (Cacti Import Packages RCE)

Reference Information

CVE: CVE-2024-25641, CVE-2024-29894, CVE-2024-31443, CVE-2024-31444, CVE-2024-31445, CVE-2024-31458, CVE-2024-31459, CVE-2024-31460, CVE-2024-34340

Detections

Analytics