Описание
Cacti is an open source platform which provides a robust and extensible operational monitoring and fault management framework for users. In affected versions a command injection vulnerability allows an unauthenticated user to execute arbitrary code on a server running Cacti, if a specific data source was selected for any monitored device. The vulnerability resides in the remote_agent.php file. This file can be accessed without authentication. This function retrieves the IP address of the client via get_client_addr and resolves this IP address to the corresponding hostname via gethostbyaddr. After this, it is verified that an entry within the poller table exists, where the hostname corresponds to the resolved hostname. If such an entry was found, the function returns true and the client is authorized. This authorization can be bypassed due to the implementation of the get_client_addr function. The function is defined in the file lib/functions.php and checks serval `$_SE...
| Релиз | Статус | Примечание |
|---|---|---|
| bionic | ignored | end of standard support, was needs-triage |
| devel | not-affected | 1.2.28+ds1-2ubuntu1 |
| esm-apps/bionic | released | 1.1.38+ds1-1ubuntu0.1~esm4 |
| esm-apps/focal | released | 1.2.10+ds1-1ubuntu1.1+esm2 |
| esm-apps/jammy | released | 1.2.19+ds1-2ubuntu1.1+esm2 |
| esm-apps/noble | not-affected | 1.2.26+ds1-1ubuntu0.1 |
| esm-apps/xenial | not-affected | code not present |
| esm-infra-legacy/trusty | not-affected | code not present |
| focal | ignored | end of standard support, was needed |
| jammy | needed |
Показывать по
Ссылки на источники
EPSS
9.8 Critical
CVSS3
Связанные уязвимости
Cacti is an open source platform which provides a robust and extensible operational monitoring and fault management framework for users. In affected versions a command injection vulnerability allows an unauthenticated user to execute arbitrary code on a server running Cacti, if a specific data source was selected for any monitored device. The vulnerability resides in the `remote_agent.php` file. This file can be accessed without authentication. This function retrieves the IP address of the client via `get_client_addr` and resolves this IP address to the corresponding hostname via `gethostbyaddr`. After this, it is verified that an entry within the `poller` table exists, where the hostname corresponds to the resolved hostname. If such an entry was found, the function returns `true` and the client is authorized. This authorization can be bypassed due to the implementation of the `get_client_addr` function. The function is defined in the file `lib/functions.php` and checks serval `$_SERVE
Cacti is an open source platform which provides a robust and extensibl ...
Уязвимость реализации сценария remote_agent.php программного средства мониторинга сети Cacti, позволяющая нарушителю выполнить произвольные команды
EPSS
9.8 Critical
CVSS3