{"id":"CVE-2020-13230","aliases":["DEBIAN-CVE-2020-13230","DLA-2965-1","EUVD-2020-5499","GHSA-pqfc-vh74-fmv2","UBUNTU-CVE-2020-13230","USN-5214-1"],"status":"published","title":"In Cacti before 1.2.11, disabling a user account does not immediately invalidate any permissions...","description":"In Cacti before 1.2.11, disabling a user account does not immediately invalidate any permissions granted to that account (e.g., permission to view logs).","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.01,"percentile":0.63273,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-281"],"published":"2020-05-20T13:40:45Z","modified":"2026-10-26T12:02:25Z","fixes":[{"ecosystem":"Debian:12","package":"cacti","fixed_in":["1.2.11+ds1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"cacti","fixed_in":["1.2.11+ds1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"cacti","fixed_in":["1.2.11+ds1-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"cacti","fixed_in":["0.8.8f+ds1-4ubuntu4.16.04.2+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"cacti","fixed_in":["1.1.38+ds1-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"cacti","fixed_in":["1.2.10+ds1-1ubuntu1+esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.11+ds1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.11+ds1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.11+ds1-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.8h+ds1-10+deb9u2"}]}],"versions":["0.8.8h+ds1-10","0.8.8h+ds1-10+deb9u1"],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.8.8b+dfsg-3","0.8.8b+dfsg-5","0.8.8b+dfsg-5ubuntu0.1","0.8.8b+dfsg-5ubuntu0.2","0.8.8b+dfsg-5ubuntu0.2+esm1","0.8.8b+dfsg-5ubuntu0.2+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.8f+ds1-4ubuntu4.16.04.2+esm1"}]}],"versions":["0.8.8f+ds1-2","0.8.8f+ds1-3","0.8.8f+ds1-4","0.8.8f+ds1-4ubuntu1","0.8.8f+ds1-4ubuntu2","0.8.8f+ds1-4ubuntu3","0.8.8f+ds1-4ubuntu4","0.8.8f+ds1-4ubuntu4.16.04","0.8.8f+ds1-4ubuntu4.16.04.1","0.8.8f+ds1-4ubuntu4.16.04.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.38+ds1-1ubuntu0.1~esm1"}]}],"versions":["1.1.18+ds1-1","1.1.27+ds1-2","1.1.27+ds1-3","1.1.28+ds1-2","1.1.35+ds1-1","1.1.36+ds1-1","1.1.38+ds1-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.10+ds1-1ubuntu1+esm1"}]}],"versions":["1.2.4+ds1-2ubuntu3","1.2.9+ds1-1ubuntu1","1.2.9+ds1-1ubuntu2","1.2.10+ds1-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.8f+ds1-4ubuntu4.16.04.2+esm1"}]}],"versions":["0.8.8f+ds1-2","0.8.8f+ds1-3","0.8.8f+ds1-4","0.8.8f+ds1-4ubuntu1","0.8.8f+ds1-4ubuntu2","0.8.8f+ds1-4ubuntu3","0.8.8f+ds1-4ubuntu4","0.8.8f+ds1-4ubuntu4.16.04","0.8.8f+ds1-4ubuntu4.16.04.1","0.8.8f+ds1-4ubuntu4.16.04.2"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.38+ds1-1ubuntu0.1~esm1"}]}],"versions":["1.1.18+ds1-1","1.1.27+ds1-2","1.1.27+ds1-3","1.1.28+ds1-2","1.1.35+ds1-1","1.1.36+ds1-1","1.1.38+ds1-1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.10+ds1-1ubuntu1+esm1"}]}],"versions":["1.2.4+ds1-2ubuntu3","1.2.9+ds1-1ubuntu1","1.2.9+ds1-1ubuntu2","1.2.10+ds1-1ubuntu1"],"bundled":5}],"products":[{"vendor":"cacti","product":"cacti"},{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"}],"references":[{"url":"https://github.com/Cacti/cacti/issues/3343","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Third Party Advisory","report"]},{"url":"https://github.com/Cacti/cacti/releases/tag/release%2F1.2.11","tags":["x_refsource_MISC","x_transferred","Release Notes","Third Party Advisory","advisory","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q3PCDGNELH7HEBIXRNT5J5EWQEXQAU6B/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ICJMWSY77IIGZYR6FE6NAQZFBO42VECO/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/03/msg00038.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-13230"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ICJMWSY77IIGZYR6FE6NAQZFBO42VECO/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Q3PCDGNELH7HEBIXRNT5J5EWQEXQAU6B/"},{"url":"https://github.com/advisories/GHSA-pqfc-vh74-fmv2"},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-13230","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-13230","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5214-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-13230","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-13231","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-14295","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-14424","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-35701","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2020-13230","description":"In Cacti before 1.2.11, disabling a user account does not immediately invalidate any permissions granted to that account (e.g., permission to view logs).","status":"published","published":"2020-05-20T13:40:45Z","modified":"2024-08-04T12:11:19.453Z","updated_at":"2026-11-02T14:35:54.170199Z"}],"euvd":[{"id":"EUVD-2020-5499","description":"In Cacti before 1.2.11, disabling a user account does not immediately invalidate any permissions granted to that account (e.g., permission to view logs).","status":"published","published":"2020-05-20T13:40:45Z","modified":"2024-08-04T12:11:19Z","updated_at":"2026-11-03T03:07:38.311662Z"}],"ghsa":[{"id":"GHSA-pqfc-vh74-fmv2","title":"In Cacti before 1.2.11, disabling a user account does not immediately invalidate any permissions...","description":"In Cacti before 1.2.11, disabling a user account does not immediately invalidate any permissions granted to that account (e.g., permission to view logs).","status":"published","published":"2022-05-24T17:18:12Z","modified":"2023-01-29T05:02:34Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-281"],"updated_at":"2026-11-02T14:45:07.130995Z"}],"nvd":[{"id":"CVE-2020-13230","description":"In Cacti before 1.2.11, disabling a user account does not immediately invalidate any permissions granted to that account (e.g., permission to view logs).","status":"published","published":"2020-05-20T14:15:11.407Z","modified":"2026-06-17T02:52:46.457Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-281"],"updated_at":"2026-11-02T14:06:00.784809Z"}],"osv":[{"id":"CVE-2020-13230","description":"In Cacti before 1.2.11, disabling a user account does not immediately invalidate any permissions granted to that account (e.g., permission to view logs).","status":"published","published":"2020-05-20T14:15:11.407Z","modified":"2026-10-20T10:51:10.853200784Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:14.034736Z"},{"id":"DEBIAN-CVE-2020-13230","description":"In Cacti before 1.2.11, disabling a user account does not immediately invalidate any permissions granted to that account (e.g., permission to view logs).","status":"published","published":"2020-05-20T14:15:11.407Z","modified":"2026-10-26T12:02:25.403392954Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:32.862554Z"},{"id":"UBUNTU-CVE-2020-13230","description":"In Cacti before 1.2.11, disabling a user account does not immediately invalidate any permissions granted to that account (e.g., permission to view logs).","status":"published","published":"2020-05-20T14:15:00Z","modified":"2026-02-04T02:53:14.695606Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:22.804634Z"},{"id":"DLA-2965-1","title":"cacti - security update","status":"published","published":"2022-03-29T00:00:00Z","modified":"2026-03-09T01:18:05.251587Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"USN-5214-1","title":"cacti vulnerabilities","description":"It was discovered that Cacti was incorrectly validating permissions\nfor user accounts that had been recently disabled. An authenticated\nattacker could possibly use this to obtain unauthorized access to\napplication and system data. (CVE-2020-13230)\n\nIt was discovered that Cacti was incorrectly performing authorization\nchecks in auth_profile.php. A remote unauthenticated attacker could\nuse this to perform a CSRF attack and set a new admin email or make\nother changes. This issue only affected Ubuntu 18.04 ESM and\nUbuntu 20.04 ESM. (CVE-2020-13231)\n\nIt was discovered that Cacti incorrectly handled user provided input\nsent through request parameters to the color.php script. A remote\nauthenticated attacker could use this issue to perform SQL injection\nattacks. This issue only affected Ubuntu 18.04 ESM and Ubuntu 20.04 ESM.\n(CVE-2020-14295)\n\nIt was discovered that Cacti did not properly escape file input fields\nwhen performing template import operations for various themes. An\nauthenticated attacker could use this to perform XSS attacks. This issue\nonly affected Ubuntu 18.04 ESM and Ubuntu 20.04 ESM. (CVE-2020-14424)\n\nIt was discovered that Cacti incorrectly handled user provided input\nsent through request parameters to the data_debug.php script. A remote\nauthenticated attacker could use this issue to perform SQL injection\nattacks. This issue only affected Ubuntu 20.04 ESM. (CVE-2020-35701)\n","status":"published","published":"2022-06-09T09:14:15Z","modified":"2026-06-25T13:30:55.043665956Z","updated_at":"2026-11-02T16:58:15.683829Z"}]}}