{"id":"CVE-2019-17358","aliases":["ALPINE-CVE-2019-17358","DEBIAN-CVE-2019-17358","DLA-2032-1","DSA-4604-1","EUVD-2019-7768","GHSA-7mqg-g2q4-78m2","UBUNTU-CVE-2019-17358","openSUSE-SU-2020:0272-1","openSUSE-SU-2020:0284-1","openSUSE-SU-2020:0558-1","openSUSE-SU-2020:0565-1","openSUSE-SU-2024:10670-1"],"status":"published","title":"Cacti through 1.2.7 is affected by multiple instances of lib/functions.php unsafe deserialization...","description":"Cacti through 1.2.7 is affected by multiple instances of lib/functions.php unsafe deserialization of user-controlled data to populate arrays. An authenticated attacker could use this to influence object data values and control actions taken by Cacti or potentially cause memory corruption in the PHP module.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.03033,"percentile":0.87583,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-502","CWE-787"],"published":"2019-12-11T00:00:00Z","modified":"2026-11-03T06:32:29Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"cacti","fixed_in":["1.2.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"cacti","fixed_in":["1.2.8-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"cacti","fixed_in":["1.2.8+ds1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"cacti","fixed_in":["1.2.8+ds1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"cacti","fixed_in":["1.2.8+ds1-1"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"cacti","fixed_in":["0.8.8b+dfsg-8+deb8u8"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"cacti","fixed_in":["0.8.8h+ds1-10+deb9u1"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"cacti","fixed_in":["1.2.2+ds1-2+deb10u2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"cacti","fixed_in":["0.8.8b+dfsg-5ubuntu0.2+esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.8-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.8+ds1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.8+ds1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.8+ds1-1"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.8b+dfsg-8+deb8u8"}]}],"versions":["0.8.8b+dfsg-8","0.8.8b+dfsg-8+deb8u1","0.8.8b+dfsg-8+deb8u2","0.8.8b+dfsg-8+deb8u3","0.8.8b+dfsg-8+deb8u4","0.8.8b+dfsg-8+deb8u5","0.8.8b+dfsg-8+deb8u6","0.8.8b+dfsg-8+deb8u7"]},{"source":"osv","ecosystem":"Debian:9","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.8h+ds1-10+deb9u1"}]}],"versions":["0.8.8h+ds1-10"]},{"source":"osv","ecosystem":"Debian:10","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.2+ds1-2+deb10u2"}]}],"versions":["1.2.2+ds1-2","1.2.2+ds1-2+deb10u1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.8b+dfsg-5ubuntu0.2+esm1"}]}],"versions":["0.8.8b+dfsg-3","0.8.8b+dfsg-5","0.8.8b+dfsg-5ubuntu0.1","0.8.8b+dfsg-5ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.8.8f+ds1-2","0.8.8f+ds1-3","0.8.8f+ds1-4","0.8.8f+ds1-4ubuntu1","0.8.8f+ds1-4ubuntu2","0.8.8f+ds1-4ubuntu3","0.8.8f+ds1-4ubuntu4","0.8.8f+ds1-4ubuntu4.16.04","0.8.8f+ds1-4ubuntu4.16.04.1","0.8.8f+ds1-4ubuntu4.16.04.2","0.8.8f+ds1-4ubuntu4.16.04.2+esm1","0.8.8f+ds1-4ubuntu4.16.04.2+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.18+ds1-1","1.1.27+ds1-2","1.1.27+ds1-3","1.1.28+ds1-2","1.1.35+ds1-1","1.1.36+ds1-1","1.1.38+ds1-1","1.1.38+ds1-1ubuntu0.1~esm1","1.1.38+ds1-1ubuntu0.1~esm3","1.1.38+ds1-1ubuntu0.1~esm4"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.9-lp151.3.3.1"}]}],"bundled":10},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"cacti-spine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.9-lp151.3.3.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP1","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.9-bp151.4.3.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP1","package":"cacti-spine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.9-bp151.4.3.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Package Hub 12","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.11-5.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Package Hub 12","package":"cacti-spine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.11-2.1"}]}],"bundled":11},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.11-5.1"}]}],"bundled":11},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"cacti-spine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.11-2.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP1","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.11-bp151.4.6.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP1","package":"cacti-spine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.11-bp151.4.6.1"}]}],"bundled":11},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.18-1.2"}]}],"bundled":31}],"products":[{"vendor":"cacti","product":"cacti"},{"vendor":"debian","product":"debian_linux"},{"vendor":"opensuse","product":"leap"}],"references":[{"url":"https://www.darkmatter.ae/xen1thlabs/","tags":["x_refsource_MISC","x_transferred","Not Applicable","web"]},{"url":"https://github.com/Cacti/cacti/blob/79f29cddb5eb05cbaff486cd634285ef1fed9326/lib/functions.php#L3109","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence"]},{"url":"https://lists.debian.org/debian-lts-announce/2019/12/msg00014.html","tags":["x_refsource_MISC","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://github.com/Cacti/cacti/issues/3026","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"https://github.com/Cacti/cacti/commit/adf221344359f5b02b8aed43dfb6b33ae5d708c8","tags":["x_refsource_MISC","x_transferred","Product","Third Party Advisory","fix","report"]},{"url":"https://bugzilla.suse.com/show_bug.cgi?id=CVE-2019-17358","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"https://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-17358.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory"]},{"url":"https://seclists.org/bugtraq/2020/Jan/25","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","web"]},{"url":"https://www.debian.org/security/2020/dsa-4604","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00001.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00005.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://security.gentoo.org/glsa/202003-40","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00042.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00048.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-17358"},{"url":"https://github.com/advisories/GHSA-7mqg-g2q4-78m2"},{"url":"https://security.alpinelinux.org/vuln/CVE-2019-17358","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-17358","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-17358","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-17358","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/QJH5OTPHSPMFV4CORKBXMWKMQWVD3CC5/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1082318","tags":["report"]},{"url":"https://bugzilla.suse.com/1101024","tags":["report"]},{"url":"https://bugzilla.suse.com/1101139","tags":["report"]},{"url":"https://bugzilla.suse.com/1122242","tags":["report"]},{"url":"https://bugzilla.suse.com/1122243","tags":["report"]},{"url":"https://bugzilla.suse.com/1122244","tags":["report"]},{"url":"https://bugzilla.suse.com/1122245","tags":["report"]},{"url":"https://bugzilla.suse.com/1122535","tags":["report"]},{"url":"https://bugzilla.suse.com/1158990","tags":["report"]},{"url":"https://bugzilla.suse.com/1158992","tags":["report"]},{"url":"https://bugzilla.suse.com/1161297","tags":["report"]},{"url":"https://bugzilla.suse.com/1163749","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2009-4112","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20723","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20724","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20725","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20726","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-16723","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17357","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17358","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-7106","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-7237","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/E42YKBXB3DG7EDJCOOGLDZ757NRYDL6I/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/I7VM65WPOCAD6HUODTOBDF4DOY2KSANI/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1164675","tags":["report"]},{"url":"https://bugzilla.suse.com/1169215","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8813","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/ZCYZNXPQBT3RNEEVMDXCIG76SLTOPTF5/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2006-6799","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-3112","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-4000","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-10970","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-11163","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-11691","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12065","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12927","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12978","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15194","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-16641","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-16660","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-16661","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-16785","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11022","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13625","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14295","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14424","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-25706","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-35701","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-17358","description":"Cacti through 1.2.7 is affected by multiple instances of lib/functions.php unsafe deserialization of user-controlled data to populate arrays. An authenticated attacker could use this to influence object data values and control actions taken by Cacti or potentially cause memory corruption in the PHP module.","status":"published","published":"2019-12-12T13:53:51Z","modified":"2024-08-05T01:40:15.256Z","updated_at":"2026-11-02T14:20:24.678649Z"}],"euvd":[{"id":"EUVD-2019-7768","description":"Cacti through 1.2.7 is affected by multiple instances of lib/functions.php unsafe deserialization of user-controlled data to populate arrays. An authenticated attacker could use this to influence object data values and control actions taken by Cacti or potentially cause memory corruption in the PHP module.","status":"published","published":"2019-12-12T13:53:51Z","modified":"2024-08-05T01:40:15Z","updated_at":"2026-11-03T02:40:30.328063Z"}],"ghsa":[{"id":"GHSA-7mqg-g2q4-78m2","title":"Cacti through 1.2.7 is affected by multiple instances of lib/functions.php unsafe deserialization...","description":"Cacti through 1.2.7 is affected by multiple instances of lib/functions.php unsafe deserialization of user-controlled data to populate arrays. An authenticated attacker could use this to influence object data values and control actions taken by Cacti or potentially cause memory corruption in the PHP module.","status":"published","published":"2022-05-24T17:03:21Z","modified":"2023-01-29T05:00:39Z","updated_at":"2026-11-02T14:44:38.410251Z"}],"nvd":[{"id":"CVE-2019-17358","description":"Cacti through 1.2.7 is affected by multiple instances of lib/functions.php unsafe deserialization of user-controlled data to populate arrays. An authenticated attacker could use this to influence object data values and control actions taken by Cacti or potentially cause memory corruption in the PHP module.","status":"published","published":"2019-12-12T14:15:16.133Z","modified":"2026-06-17T02:23:48.017Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5.5,"vector":"AV:N/AC:L/Au:S/C:N/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-502","CWE-787"],"updated_at":"2026-11-02T14:05:40.258829Z"}],"osv":[{"id":"ALPINE-CVE-2019-17358","description":"Cacti through 1.2.7 is affected by multiple instances of lib/functions.php unsafe deserialization of user-controlled data to populate arrays. An authenticated attacker could use this to influence object data values and control actions taken by Cacti or potentially cause memory corruption in the PHP module.","status":"published","published":"2019-12-12T14:15:16.133Z","modified":"2026-11-03T06:32:29.536491419Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T07:17:41.158523Z"},{"id":"CVE-2019-17358","description":"Cacti through 1.2.7 is affected by multiple instances of lib/functions.php unsafe deserialization of user-controlled data to populate arrays. An authenticated attacker could use this to influence object data values and control actions taken by Cacti or potentially cause memory corruption in the PHP module.","status":"published","published":"2019-12-12T14:15:16.133Z","modified":"2026-10-20T10:50:48.707013627Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:11.673963Z"},{"id":"DEBIAN-CVE-2019-17358","description":"Cacti through 1.2.7 is affected by multiple instances of lib/functions.php unsafe deserialization of user-controlled data to populate arrays. An authenticated attacker could use this to influence object data values and control actions taken by Cacti or potentially cause memory corruption in the PHP module.","status":"published","published":"2019-12-12T14:15:16.133Z","modified":"2026-09-21T07:02:28.326835353Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:31.867036Z"},{"id":"UBUNTU-CVE-2019-17358","description":"Cacti through 1.2.7 is affected by multiple instances of lib/functions.php unsafe deserialization of user-controlled data to populate arrays. An authenticated attacker could use this to influence object data values and control actions taken by Cacti or potentially cause memory corruption in the PHP module.","status":"published","published":"2019-12-12T14:15:00Z","modified":"2025-09-08T16:45:38Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:20.325378Z"},{"id":"DLA-2032-1","title":"cacti - security update","status":"published","published":"2019-12-11T00:00:00Z","modified":"2026-03-09T01:20:04.139191Z","updated_at":"2026-11-02T15:46:10.227108Z"},{"id":"DSA-4604-1","title":"cacti - security update","status":"published","published":"2020-01-19T00:00:00Z","modified":"2026-03-09T02:08:56.907925Z","updated_at":"2026-11-02T15:46:17.19998Z"},{"id":"openSUSE-SU-2020:0272-1","title":"Security update for cacti, cacti-spine","description":"This update for cacti, cacti-spine fixes the following issues:\n\ncacti-spine was updated to version 1.2.9.\n\n\nSecurity issues fixed:\n\n- CVE-2009-4112: Fixed a privilege escalation (bsc#1122535).\n- CVE-2018-20723: Fixed a cross-site scripting (XSS) vulnerability (bsc#1122245).\n- CVE-2018-20724: Fixed a cross-site scripting (XSS) vulnerability (bsc#1122244).\n- CVE-2018-20725: Fixed a privilege escalation that could occur under certain conditions (bsc#1122535).\n- CVE-2018-20726: Fixed a cross-site scripting (XSS) vulnerability (bsc#1122242).\n- CVE-2019-16723: Fixed an authentication bypass vulnerability.\n- CVE-2019-17357: Fixed an SQL injection vulnerability (bsc#1158990).\n- CVE-2019-17358: Fixed an unsafe deserialization in sanitize_unserialize_selected_items (bsc#1158992).\n- CVE-2020-7106: Fixed a potential cross-site scripting (XSS) vulnerability (bsc#1163749).\n- CVE-2020-7237: Fixed a remote code execution that affected privileged users via shell metacharacters in the Performance Boost Debug Log field (bsc#1161297).\n\n\nNon-security issues fixed:\n\n- Fixed missing packages php-json, php-ctype, and php-gd in cacti.spec (boo#1101024).\n- Fixed Apache2.4 and Apache2.2 runtime configuration issue (boo#1101139).\n","status":"published","published":"2020-03-01T17:12:57Z","modified":"2026-02-04T02:27:29.270751Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"openSUSE-SU-2020:0284-1","title":"Security update for cacti, cacti-spine","description":"This update for cacti, cacti-spine fixes the following issues:\n\ncacti-spine was updated to version 1.2.9.\n\n\nSecurity issues fixed:\n\n- CVE-2009-4112: Fixed a privilege escalation (bsc#1122535).\n- CVE-2018-20723: Fixed a cross-site scripting (XSS) vulnerability (bsc#1122245).\n- CVE-2018-20724: Fixed a cross-site scripting (XSS) vulnerability (bsc#1122244).\n- CVE-2018-20725: Fixed a privilege escalation that could occur under certain conditions (bsc#1122535).\n- CVE-2018-20726: Fixed a cross-site scripting (XSS) vulnerability (bsc#1122242).\n- CVE-2019-16723: Fixed an authentication bypass vulnerability.\n- CVE-2019-17357: Fixed an SQL injection vulnerability (bsc#1158990).\n- CVE-2019-17358: Fixed an unsafe deserialization in sanitize_unserialize_selected_items (bsc#1158992).\n- CVE-2020-7106: Fixed a potential cross-site scripting (XSS) vulnerability (bsc#1163749).\n- CVE-2020-7237: Fixed a remote code execution that affected privileged users via shell metacharacters in the Performance Boost Debug Log field (bsc#1161297).\n\n\nNon-security issues fixed:\n\n- Fixed missing packages php-json, php-ctype, and php-gd in cacti.spec (boo#1101024).\n- Fixed Apache2.4 and Apache2.2 runtime configuration issue (boo#1101139).\n\nThis update was imported from the openSUSE:Leap:15.1:Update update project.","status":"published","published":"2020-03-02T12:20:59Z","modified":"2026-02-04T02:20:34.781286Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"openSUSE-SU-2020:0558-1","title":"Security update for cacti, cacti-spine","description":"This update for cacti, cacti-spine to version 1.2.11 fixes the following issues:\n\nThis update is fixing multiple vulnerabilities and adding bug fixes. For more details consult the changes file.\n","status":"published","published":"2020-04-27T18:18:08Z","modified":"2026-02-04T04:17:53.931354Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"openSUSE-SU-2020:0565-1","title":"Security update for cacti, cacti-spine","description":"This update for cacti, cacti-spine to version 1.2.11 fixes the following issues:\n\nThis update is fixing multiple vulnerabilities and adding bug fixes. For more details consult the changes file.\n\nThis update was imported from the openSUSE:Leap:15.1:Update update project.","status":"published","published":"2020-04-30T15:35:25Z","modified":"2026-02-04T04:29:57.268103Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"openSUSE-SU-2024:10670-1","title":"cacti-1.2.18-1.2 on GA media","description":"These are all security issues fixed in the cacti-1.2.18-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:13:56.743451Z","updated_at":"2026-11-02T16:58:34.487567Z"}]}}