Security update for cacti, cacti-spine
This update for cacti, cacti-spine to version 1.2.11 fixes the following issues:
This update is fixing multiple vulnerabilities and adding bug fixes. For more details consult the changes file.
-
Submitted by
Andreas Stieger (AndreasStieger)
Fixed bugs
bnc#1122535
VUL-1: CVE-2009-4112: cacti: Privilege escalation under certain conditions
bnc#1169215
VUL-0: cacti: multiple vulnerabilities fixed and security hardening applied in 1.2.11
bnc#1158992
VUL-0: CVE-2019-17358: cacti: Unsafe deserialization in sanitize_unserialize_selected_items
bnc#1164675
VUL-0: CVE-2020-8813: cacti: remote attackers may execute arbitrary OS commands via shell metacharacters in a cookie, if a guest user has the graph real-time privilege
bnc#1122244
VUL-1: CVE-2018-20724: cacti: cross-site scripting (XSS) vulnerability exists in pollers.php due to lack of escaping of unintended characters in the Website Hostname for Data Collectors.
bnc#1122242
VUL-1: CVE-2018-20726: cacti: cross-site scripting (XSS) vulnerability exists in host.php (via tree.php) in Cacti in the Website Hostname field for Devices.
bnc#1122243
VUL-1: CVE-2018-20725: cacti: cross-site scripting (XSS) vulnerability exists in graph_templates.php due to lack of escaping of unintended characters in the Graph Vertical Label.
bnc#1161297
VUL-0: CVE-2020-7237: cacti: Remote Code Execution (by privileged users) via shell metacharacters in the Performance Boost Debug Log field of poller_automation.php
bnc#1122245
VUL-1: CVE-2018-20723: cacti: cross-site scripting (XSS) vulnerability exists in color_templates.php due to lack of escaping of unintended characters in the Name field for a Color.
bnc#1082318
Packages must not mark license files as %doc
bnc#1158990
VUL-0: CVE-2019-17357: cacti: sql injection in graphs.php
