Vulnerability Details : CVE-2020-8813
graph_realtime.php in Cacti 1.2.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in a cookie, if a guest user has the graph real-time privilege.
Products affected by CVE-2020-8813
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*
- cpe:2.3:a:cacti:cacti:1.2.8:*:*:*:*:*:*:*
- cpe:2.3:o:opensuse:suse_package_hub:*:*:*:*:*:*:*:*
- cpe:2.3:a:opmantek:open-audit:3.3.1:*:*:*:-:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2020-8813
91.44%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 99 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2020-8813
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
9.3
|
HIGH | AV:N/AC:M/Au:N/C:C/I:C/A:C |
8.6
|
10.0
|
NIST | |
8.8
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
2.8
|
5.9
|
NIST |
CWE ids for CVE-2020-8813
-
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.Assigned by: nvd@nist.gov (Primary)
References for CVE-2020-8813
-
https://gist.github.com/mhaskar/ebe6b74c32fd0f7e1eedf1aabfd44129
cacti-exploit.py · GitHubExploit;Third Party Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00042.html
[security-announce] openSUSE-SU-2020:0558-1: important: Security updateMailing List;Third Party Advisory
-
https://drive.google.com/file/d/1A8hxTyk_NgSp04zPX-23nPbsSDeyDFio/view
CactiExploit-2020-02-08_05.46.38.mp4 - Google DriveExploit;Third Party Advisory
-
http://packetstormsecurity.com/files/157477/Open-AudIT-Professional-3.3.1-Remote-Code-Execution.html
Open-AudIT Professional 3.3.1 Remote Code Execution ≈ Packet StormThird Party Advisory;VDB Entry
-
http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00048.html
[security-announce] openSUSE-SU-2020:0565-1: important: Security updateExploit;Third Party Advisory
-
http://packetstormsecurity.com/files/156593/Cacti-1.2.8-Unauthenticated-Remote-Code-Execution.html
Cacti 1.2.8 Unauthenticated Remote Code Execution ≈ Packet StormThird Party Advisory;VDB Entry
-
http://packetstormsecurity.com/files/156537/Cacti-1.2.8-Unauthenticated-Remote-Code-Execution.html
Cacti 1.2.8 Unauthenticated Remote Code Execution ≈ Packet StormThird Party Advisory;VDB Entry
-
https://github.com/Cacti/cacti/releases
Releases · Cacti/cacti · GitHubRelease Notes
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WAX3LDXPIKWNBGVZSIMZV7LI5K6BZRTO/
[SECURITY] Fedora 32 Update: cacti-1.2.10-1.fc32 - package-announce - Fedora Mailing-ListsMailing List;Third Party Advisory
-
https://security.gentoo.org/glsa/202004-16
Cacti: Multiple vulnerabilities (GLSA 202004-16) — Gentoo securityThird Party Advisory
-
https://shells.systems/cacti-v1-2-8-authenticated-remote-code-execution-cve-2020-8813/
Cacti v1.2.8 authenticated Remote Code Execution (CVE-2020-8813) - Shells.SystemsExploit;Third Party Advisory
-
https://github.com/Cacti/cacti/issues/3285
When guest users have access to realtime graphs, remote code could be executed (CVE-2020-8813) · Issue #3285 · Cacti/cacti · GitHubIssue Tracking;Third Party Advisory
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XEMDQXDRNQYXOME7TACKDVCXZXZNGZE2/
[SECURITY] Fedora 31 Update: cacti-1.2.10-1.fc31 - package-announce - Fedora Mailing-ListsMailing List;Third Party Advisory
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M77SS33IDVNGBU566TK2XVULPW3RXUQ4/
[SECURITY] Fedora 30 Update: cacti-spine-1.2.10-1.fc30 - package-announce - Fedora Mailing-ListsMailing List;Third Party Advisory
-
http://packetstormsecurity.com/files/156538/Cacti-1.2.8-Authenticated-Remote-Code-Execution.html
Cacti 1.2.8 Authenticated Remote Code Execution ≈ Packet StormThird Party Advisory;VDB Entry
-
https://lists.debian.org/debian-lts-announce/2022/12/msg00039.html
[SECURITY] [DLA 3252-1] cacti security updateMailing List;Third Party Advisory
Jump to