CVE-2017-12065
spikekill.php in Cacti before 1.1.16 might allow remote attackers to execute arbitrary code via...
spikekill.php in Cacti before 1.1.16 might allow remote attackers to execute arbitrary code via the avgnan, outlier-start, or outlier-end parameter.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
spikekill.php in Cacti before 1.1.16 might allow remote attackers to execute arbitrary code via the avgnan, outlier-start, or outlier-end parameter.
- Record
CVE-2017-12065- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
spikekill.php in Cacti before 1.1.16 might allow remote attackers to execute arbitrary code via the avgnan, outlier-start, or outlier-end parameter.
- Record
CVE-2017-12065- Updated
- 2026-11-02
EUVDEUVD-2017-3651 No score
spikekill.php in Cacti before 1.1.16 might allow remote attackers to execute arbitrary code via the avgnan, outlier-start, or outlier-end parameter.
- Record
EUVD-2017-3651- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-mcjp-rpv5-ppq7
spikekill.php in Cacti before 1.1.16 might allow remote attackers to execute arbitrary code via...
spikekill.php in Cacti before 1.1.16 might allow remote attackers to execute arbitrary code via the avgnan, outlier-start, or outlier-end parameter.
- Record
GHSA-mcjp-rpv5-ppq7- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSV
spikekill.php in Cacti before 1.1.16 might allow remote attackers to execute arbitrary code via the avgnan, outlier-start, or outlier-end parameter.
- Record
CVE-2017-12065- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2017-12065
spikekill.php in Cacti before 1.1.16 might allow remote attackers to execute arbitrary code via the avgnan, outlier-start, or outlier-end parameter.
- Record
DEBIAN-CVE-2017-12065- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2017-0267 No score
Updated cacti packages fix security vulnerabilities
Cross-site scripting (XSS) vulnerability in link.php in Cacti 1.1.12 allows remote anonymous users to inject arbitrary web script or HTML via the id parameter, related to the die_html_input_error function in lib/html_validate.php (CVE-2017-10970).
Cross-site scripting (XSS) vulnerability in aggregate_graphs.php in Cacti 1.1.12 allows remote authenticated users to inject arbitrary web script or HTML via specially crafted HTTP Referer headers, related to the $cancel_url variable (CVE-2017-11163).
A Cross-site scripting vulnerability exists in cacti before 1.1.14 in the user profile managment page (auth_profile.php), allowing inject arbitrary web script or HTML via specially crafted HTTP Referer headers (CVE-2017-11691).
spikekill.php in Cacti before 1.1.16 might allow remote attackers to execute arbitrary code via the avgnan, outlier-start, or outlier-end parameter (CVE-2017-12065).
Cross-site scripting (XSS) vulnerability in aggregate_graphs.php in Cacti before 1.1.16 allows remote authenticated users to inject arbitrary web script or HTML via specially crafted HTTP Referer headers, related to the $cancel_url variable (CVE-2017-12066).
- Record
MGASA-2017-0267- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10670-1 No score
cacti-1.2.18-1.2 on GA media
These are all security issues fixed in the cacti-1.2.18-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10670-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
cactiDebian:12 |
before 1.1.16+ds1-1 | 1.1.16+ds1-1 |
cactiDebian:13 |
before 1.1.16+ds1-1 | 1.1.16+ds1-1 |
cactiDebian:14 |
before 1.1.16+ds1-1 | 1.1.16+ds1-1 |
cactiMageia:6 From an advisory covering 5 CVEs |
before 1.1.16-1.mga6 | 1.1.16-1.mga6 |
cactiopenSUSE:Tumbleweed From an advisory covering 31 CVEs |
before 1.2.18-1.2 | 1.2.18-1.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-12065 is a critical vulnerability (CVSS 9.8) in Cacti, published August 1, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.92%, the 87th percentile. Fixed in cacti 1.1.16+ds1-1.
References
cacti.net/release_notes.php?version=1.1.16
securityfocus.com/bid/100080
github.com/Cacti/cacti/commit/bd0e586f6f46d814930226f1516a194e7e72293e
security.gentoo.org/glsa/201711-10
nvd.nist.gov/vuln/detail/CVE-2017-12065
Show 40 moreShow less
security-tracker.debian.org/tracker/CVE-2017-12065
advisories.mageia.org/MGASA-2017-0267.html
bugs.mageia.org/show_bug.cgi?id=21242
cacti.net/changelog.php
lists.fedoraproject.org/archives/list/[email protected]/thread/7MRJCGVNDLW7RCTYSL72XGP74PCMOIH2
openwall.com/lists/oss-security/2017/07/27/1
lists.opensuse.org/opensuse-updates/2017-08/msg00018.html
suse.com/security/cve/CVE-2006-6799