VulnerabilityModified
CVE-2010-1645
Cacti before 0.8.7f, as used in Red Hat High Performance Computing (HPC) Solution and other products, allows remote authenticated administrators to execute arbitrary commands via shell metacharacters in (1) the FQDN field of a Device or (2) the Vertical…
MEDIUM 6.5EPSS 2.80%
Does this matter?
Lower severity and a low EPSS score (2.80%). Track it; it rarely justifies an emergency change on its own.
Description
Cacti before 0.8.7f, as used in Red Hat High Performance Computing (HPC) Solution and other products, allows remote authenticated administrators to execute arbitrary commands via shell metacharacters in (1) the FQDN field of a Device or (2) the Vertical Label field of a Graph Template.
- CVSS 2.0
- 6.5 MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
- EPSS
- 2.80% probability · 86th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-20
- Affected
- cacti/cacti
- Source
- secalert@redhat.com
References
- http://secunia.com/advisories/41041Vendor Advisory
- http://svn.cacti.net/viewvc?view=rev&revision=5778
- http://svn.cacti.net/viewvc?view=rev&revision=5782
- http://svn.cacti.net/viewvc?view=rev&revision=5784
- http://www.bonsai-sec.com/en/research/vulnerabilities/cacti-os-command-injection-0105.php
- http://www.cacti.net/release_notes_0_8_7f.php
- http://www.mandriva.com/security/advisories?name=MDVSA-2010:160
- http://www.vupen.com/english/advisories/2010/2132
- https://bugzilla.redhat.com/show_bug.cgi?id=609115
- https://rhn.redhat.com/errata/RHSA-2010-0635.html
- http://secunia.com/advisories/41041Vendor Advisory
- http://svn.cacti.net/viewvc?view=rev&revision=5778
- http://svn.cacti.net/viewvc?view=rev&revision=5782
- http://svn.cacti.net/viewvc?view=rev&revision=5784
- http://www.bonsai-sec.com/en/research/vulnerabilities/cacti-os-command-injection-0105.php
- http://www.cacti.net/release_notes_0_8_7f.php
- http://www.mandriva.com/security/advisories?name=MDVSA-2010:160
- http://www.vupen.com/english/advisories/2010/2132
- https://bugzilla.redhat.com/show_bug.cgi?id=609115
- https://rhn.redhat.com/errata/RHSA-2010-0635.html
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.