CVE-2020-14295

A SQL injection issue in color.php in Cacti 1.2.12 allows an admin to inject SQL via the filter parameter. This can lead to remote command execution because the product accepts stacked queries.

A SQL injection issue in color.php in Cacti 1.2.12 allows an admin to inject SQL via the filter parameter. This can lead to remote command execution because the product accepts stacked queries.

This update for cacti, cacti-spine fixes the following issues:

• cacti 1.2.13:

  • Query XSS vulnerabilities require vendor package update (CVE-2020-11022 / CVE-2020-11023)
  • Lack of escaping on some pages can lead to XSS exposure
  • Update PHPMailer to 6.1.6 (CVE-2020-13625)
  • SQL Injection vulnerability due to input validation failure when editing colors (CVE-2020-14295, boo#1173090)
  • Lack of escaping on template import can lead to XSS exposure

• switch from cron to systemd timers (boo#1115436):

  • cacti-cron.timer
  • cacti-cron.service

• avoid potential root escalation on systems with fs.protected_hardlinks=0 (boo#1154087): handle directory permissions in file section instead of using chown during post installation

• rewrote apache configuration to get rid of .htaccess files and explicitely disable directory permissions per default (only allow a limited, well-known set of directories)

This update for cacti, cacti-spine fixes the following issues:

• cacti 1.2.13:

  • Query XSS vulnerabilities require vendor package update (CVE-2020-11022 / CVE-2020-11023)
  • Lack of escaping on some pages can lead to XSS exposure
  • Update PHPMailer to 6.1.6 (CVE-2020-13625)
  • SQL Injection vulnerability due to input validation failure when editing colors (CVE-2020-14295, boo#1173090)
  • Lack of escaping on template import can lead to XSS exposure

• switch from cron to systemd timers (boo#1115436):

  • cacti-cron.timer
  • cacti-cron.service

• avoid potential root escalation on systems with fs.protected_hardlinks=0 (boo#1154087): handle directory permissions in file section instead of using chown during post installation

• rewrote apache configuration to get rid of .htaccess files and explicitely disable directory permissions per default (only allow a limited, well-known set of directories)

This update was imported from the openSUSE:Leap:15.1:Update update project.

These are all security issues fixed in the cacti-1.2.18-1.2 package on the GA media of openSUSE Tumbleweed.

It was discovered that Cacti was incorrectly validating permissions for user accounts that had been recently disabled. An authenticated attacker could possibly use this to obtain unauthorized access to application and system data. (CVE-2020-13230)

It was discovered that Cacti was incorrectly performing authorization checks in auth_profile.php. A remote unauthenticated attacker could use this to perform a CSRF attack and set a new admin email or make other changes. This issue only affected Ubuntu 18.04 ESM and Ubuntu 20.04 ESM. (CVE-2020-13231)

It was discovered that Cacti incorrectly handled user provided input sent through request parameters to the color.php script. A remote authenticated attacker could use this issue to perform SQL injection attacks. This issue only affected Ubuntu 18.04 ESM and Ubuntu 20.04 ESM. (CVE-2020-14295)

It was discovered that Cacti did not properly escape file input fields when performing template import operations for various themes. An authenticated attacker could use this to perform XSS attacks. This issue only affected Ubuntu 18.04 ESM and Ubuntu 20.04 ESM. (CVE-2020-14424)

It was discovered that Cacti incorrectly handled user provided input sent through request parameters to the data_debug.php script. A remote authenticated attacker could use this issue to perform SQL injection attacks. This issue only affected Ubuntu 20.04 ESM. (CVE-2020-35701)