CVE-2020-7237
Cacti 1.2.8 allows Remote Code Execution (by privileged users) via shell metacharacters in the...
Cacti 1.2.8 allows Remote Code Execution (by privileged users) via shell metacharacters in the Performance Boost Debug Log field of poller_automation.php. OS commands are executed when a new poller cycle begins. The attacker must be authenticated, and must have access to modify the Performance Settings of the product.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Cacti 1.2.8 allows Remote Code Execution (by privileged users) via shell metacharacters in the Performance Boost Debug Log field of poller_automation.php. OS commands are executed when a new poller cycle begins. The attacker must be authenticated, and must have access to modify the Performance Settings of the product.
- Record
CVE-2020-7237- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 9.0 High
AV:N/AC:L/Au:S/C:C/I:C/A:C - Weakness
- CWE-78
- Updated
- 2026-11-02
CVE List No score
Cacti 1.2.8 allows Remote Code Execution (by privileged users) via shell metacharacters in the Performance Boost Debug Log field of poller_automation.php. OS commands are executed when a new poller cycle begins. The attacker must be authenticated, and must have access to modify the Performance Settings of the product.
- Record
CVE-2020-7237- Updated
- 2026-11-02
EUVDEUVD-2020-28365 No score
Cacti 1.2.8 allows Remote Code Execution (by privileged users) via shell metacharacters in the Performance Boost Debug Log field of poller_automation.php. OS commands are executed when a new poller cycle begins. The attacker must be authenticated, and must have access to modify the Performance Settings of the product.
- Record
EUVD-2020-28365- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-4wfp-xfpc-fxcp No score
Cacti 1.2.8 allows Remote Code Execution (by privileged users) via shell metacharacters in the...
Cacti 1.2.8 allows Remote Code Execution (by privileged users) via shell metacharacters in the Performance Boost Debug Log field of poller_automation.php. OS commands are executed when a new poller cycle begins. The attacker must be authenticated, and must have access to modify the Performance Settings of the product.
- Record
GHSA-4wfp-xfpc-fxcp- Updated
- 2026-11-02
OSVALPINE-CVE-2020-7237
Cacti 1.2.8 allows Remote Code Execution (by privileged users) via shell metacharacters in the Performance Boost Debug Log field of poller_automation.php. OS commands are executed when a new poller cycle begins. The attacker must be authenticated, and must have access to modify the Performance Settings of the product.
- Record
ALPINE-CVE-2020-7237- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
OSV
Cacti 1.2.8 allows Remote Code Execution (by privileged users) via shell metacharacters in the Performance Boost Debug Log field of poller_automation.php. OS commands are executed when a new poller cycle begins. The attacker must be authenticated, and must have access to modify the Performance Settings of the product.
- Record
CVE-2020-7237- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 7 moreShow less
OSVDEBIAN-CVE-2020-7237
Cacti 1.2.8 allows Remote Code Execution (by privileged users) via shell metacharacters in the Performance Boost Debug Log field of poller_automation.php. OS commands are executed when a new poller cycle begins. The attacker must be authenticated, and must have access to modify the Performance Settings of the product.
- Record
DEBIAN-CVE-2020-7237- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2020-7237
Cacti 1.2.8 allows Remote Code Execution (by privileged users) via shell metacharacters in the Performance Boost Debug Log field of poller_automation.php. OS commands are executed when a new poller cycle begins. The attacker must be authenticated, and must have access to modify the Performance Settings of the product.
- Record
UBUNTU-CVE-2020-7237- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2020:0272-1 No score
Security update for cacti, cacti-spine
This update for cacti, cacti-spine fixes the following issues:
cacti-spine was updated to version 1.2.9.
Security issues fixed:
- CVE-2009-4112: Fixed a privilege escalation (bsc#1122535).
- CVE-2018-20723: Fixed a cross-site scripting (XSS) vulnerability (bsc#1122245).
- CVE-2018-20724: Fixed a cross-site scripting (XSS) vulnerability (bsc#1122244).
- CVE-2018-20725: Fixed a privilege escalation that could occur under certain conditions (bsc#1122535).
- CVE-2018-20726: Fixed a cross-site scripting (XSS) vulnerability (bsc#1122242).
- CVE-2019-16723: Fixed an authentication bypass vulnerability.
- CVE-2019-17357: Fixed an SQL injection vulnerability (bsc#1158990).
- CVE-2019-17358: Fixed an unsafe deserialization in sanitize_unserialize_selected_items (bsc#1158992).
- CVE-2020-7106: Fixed a potential cross-site scripting (XSS) vulnerability (bsc#1163749).
- CVE-2020-7237: Fixed a remote code execution that affected privileged users via shell metacharacters in the Performance Boost Debug Log field (bsc#1161297).
Non-security issues fixed:
- Fixed missing packages php-json, php-ctype, and php-gd in cacti.spec (boo#1101024).
- Fixed Apache2.4 and Apache2.2 runtime configuration issue (boo#1101139).
- Record
openSUSE-SU-2020:0272-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2020:0284-1 No score
Security update for cacti, cacti-spine
This update for cacti, cacti-spine fixes the following issues:
cacti-spine was updated to version 1.2.9.
Security issues fixed:
- CVE-2009-4112: Fixed a privilege escalation (bsc#1122535).
- CVE-2018-20723: Fixed a cross-site scripting (XSS) vulnerability (bsc#1122245).
- CVE-2018-20724: Fixed a cross-site scripting (XSS) vulnerability (bsc#1122244).
- CVE-2018-20725: Fixed a privilege escalation that could occur under certain conditions (bsc#1122535).
- CVE-2018-20726: Fixed a cross-site scripting (XSS) vulnerability (bsc#1122242).
- CVE-2019-16723: Fixed an authentication bypass vulnerability.
- CVE-2019-17357: Fixed an SQL injection vulnerability (bsc#1158990).
- CVE-2019-17358: Fixed an unsafe deserialization in sanitize_unserialize_selected_items (bsc#1158992).
- CVE-2020-7106: Fixed a potential cross-site scripting (XSS) vulnerability (bsc#1163749).
- CVE-2020-7237: Fixed a remote code execution that affected privileged users via shell metacharacters in the Performance Boost Debug Log field (bsc#1161297).
Non-security issues fixed:
- Fixed missing packages php-json, php-ctype, and php-gd in cacti.spec (boo#1101024).
- Fixed Apache2.4 and Apache2.2 runtime configuration issue (boo#1101139).
This update was imported from the openSUSE:Leap:15.1:Update update project.
- Record
openSUSE-SU-2020:0284-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2020:0558-1 No score
Security update for cacti, cacti-spine
This update for cacti, cacti-spine to version 1.2.11 fixes the following issues:
This update is fixing multiple vulnerabilities and adding bug fixes. For more details consult the changes file.
- Record
openSUSE-SU-2020:0558-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2020:0565-1 No score
Security update for cacti, cacti-spine
This update for cacti, cacti-spine to version 1.2.11 fixes the following issues:
This update is fixing multiple vulnerabilities and adding bug fixes. For more details consult the changes file.
This update was imported from the openSUSE:Leap:15.1:Update update project.
- Record
openSUSE-SU-2020:0565-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10670-1 No score
cacti-1.2.18-1.2 on GA media
These are all security issues fixed in the cacti-1.2.18-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10670-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
cactiAlpine:v3.11 |
before 1.2.8-r0 | 1.2.8-r0 |
cactiAlpine:v3.12 |
before 1.2.8-r0 | 1.2.8-r0 |
cactiAlpine:v3.13 |
before 1.2.8-r0 | 1.2.8-r0 |
cactiAlpine:v3.14 |
before 1.2.8-r0 | 1.2.8-r0 |
cactiAlpine:v3.15 |
before 1.2.8-r0 | 1.2.8-r0 |
cactiAlpine:v3.16 |
before 1.2.8-r0 | 1.2.8-r0 |
cactiAlpine:v3.17 |
before 1.2.8-r0 | 1.2.8-r0 |
cactiAlpine:v3.18 |
before 1.2.8-r0 | 1.2.8-r0 |
cactiAlpine:v3.19 |
before 1.2.8-r0 | 1.2.8-r0 |
cactiAlpine:v3.20 |
before 1.2.8-r0 | 1.2.8-r0 |
Show 21 moreShow less
| Package | Affected | Fixed |
|---|---|---|
cactiAlpine:v3.21 |
before 1.2.8-r0 | 1.2.8-r0 |
cactiAlpine:v3.22 |
before 1.2.8-r0 | 1.2.8-r0 |
cactiAlpine:v3.23 |
before 1.2.8-r0 | 1.2.8-r0 |
cactiAlpine:v3.24 |
before 1.2.8-r0 | 1.2.8-r0 |
cactiDebian:12 |
before 1.2.9+ds1-1 | 1.2.9+ds1-1 |
cactiDebian:13 |
before 1.2.9+ds1-1 | 1.2.9+ds1-1 |
cactiDebian:14 |
before 1.2.9+ds1-1 | 1.2.9+ds1-1 |
cactiUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 0.8.8b+dfsg-30.8.8b+dfsg-50.8.8b+dfsg-5ubuntu0.10.8.8b+dfsg-5ubuntu0.20.8.8b+dfsg-5ubuntu0.2+esm10.8.8b+dfsg-5ubuntu0.2+esm2 |
None known |
cactiUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 0.8.8f+ds1-20.8.8f+ds1-30.8.8f+ds1-40.8.8f+ds1-4ubuntu10.8.8f+ds1-4ubuntu2 Show 7 moreShow less0.8.8f+ds1-4ubuntu30.8.8f+ds1-4ubuntu40.8.8f+ds1-4ubuntu4.16.040.8.8f+ds1-4ubuntu4.16.04.10.8.8f+ds1-4ubuntu4.16.04.20.8.8f+ds1-4ubuntu4.16.04.2+esm10.8.8f+ds1-4ubuntu4.16.04.2+esm2 |
None known |
cactiUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 1.1.18+ds1-11.1.27+ds1-21.1.27+ds1-31.1.28+ds1-21.1.35+ds1-1 Show 5 moreShow less1.1.36+ds1-11.1.38+ds1-11.1.38+ds1-1ubuntu0.1~esm11.1.38+ds1-1ubuntu0.1~esm31.1.38+ds1-1ubuntu0.1~esm4 |
None known |
cactiopenSUSE:Leap 15.1 |
before 1.2.9-lp151.3.3.1 | 1.2.9-lp151.3.3.1 |
cacti-spineopenSUSE:Leap 15.1 |
before 1.2.9-lp151.3.3.1 | 1.2.9-lp151.3.3.1 |
cactiSUSE:Package Hub 15 SP1 |
before 1.2.9-bp151.4.3.1 | 1.2.9-bp151.4.3.1 |
cacti-spineSUSE:Package Hub 15 SP1 |
before 1.2.9-bp151.4.3.1 | 1.2.9-bp151.4.3.1 |
cactiSUSE:Package Hub 12 |
before 1.2.11-5.1 | 1.2.11-5.1 |
cacti-spineSUSE:Package Hub 12 |
before 1.2.11-2.1 | 1.2.11-2.1 |
cactiopenSUSE:Leap 15.1 |
before 1.2.11-5.1 | 1.2.11-5.1 |
cacti-spineopenSUSE:Leap 15.1 |
before 1.2.11-2.1 | 1.2.11-2.1 |
cactiSUSE:Package Hub 15 SP1 |
before 1.2.11-bp151.4.6.1 | 1.2.11-bp151.4.6.1 |
cacti-spineSUSE:Package Hub 15 SP1 |
before 1.2.11-bp151.4.6.1 | 1.2.11-bp151.4.6.1 |
cactiopenSUSE:Tumbleweed |
before 1.2.18-1.2 | 1.2.18-1.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-7237 is a high vulnerability (CVSS 8.8) in Cacti, published January 20, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 37.1%, the 98th percentile. Fixed in cacti 1.2.8-r0.
References
github.com/Cacti/cacti/issues/3201
ctrsec.io/index.php/2020/01/25/cve-2020-7237-remote-code-execution-in-cacti-rrdtool
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SUSOTOIEJKD2IWJHN7TY56TDZJQZJUVJ
lists.opensuse.org/opensuse-security-announce/2020-03/msg00001.html
Show 60 moreShow less
security.gentoo.org/glsa/202003-40
nvd.nist.gov/vuln/detail/CVE-2020-7237
security.alpinelinux.org/vuln/CVE-2020-7237
security-tracker.debian.org/tracker/CVE-2020-7237
ubuntu.com/security/CVE-2020-7237
cve.org/CVERecord?id=CVE-2020-7237
bugzilla.suse.com/1082318
suse.com/security/cve/CVE-2009-4112