CVE-2020-7237 — Vulnetix

Try Vulnetix Request Demo

CVE-2020-7237 PUBLISHED

Cacti 1.2.8 allows Remote Code Execution (by privileged users) via shell metacharacters in the Performance Boost Debug Log field of poller_automation.php. OS commands are executed when a new poller cycle begins. The attacker must be authenticated, and must have access to modify the Performance Settings of the product.

EPSS 46.81% · 97.6th percentile

Risk Scores

EPSS Score

46.81%

97.6th percentile

Affected Products

Vendor	Product	Versions
Ubuntu:Pro:18.04:LTS	cacti	1.1.38+ds1-1ubuntu0.1~esm4, 1.1.38+ds1-1ubuntu0.1~esm3, 1.1.28+ds1-2
Ubuntu:Pro:16.04:LTS	cacti	0.8.8f+ds1-4ubuntu4.16.04.2+esm1, 0.8.8f+ds1-4ubuntu4.16.04.2+esm2, 0.8.8f+ds1-4ubuntu4.16.04
Ubuntu:Pro:14.04:LTS	cacti	0, 0.8.8b+dfsg-5ubuntu0.2+esm2, 0.8.8b+dfsg-5ubuntu0.2+esm1

Timeline

Jan 20, 2020 CVE Published
Apr 14, 2021 EPSS Score
Jun 22, 2021 EPSS Score
Oct 24, 2021 EPSS Score
Dec 25, 2021 EPSS Score
Feb 4, 2022 EPSS Score
Feb 25, 2022 EPSS Score
Apr 1, 2022 EPSS Score
Jun 29, 2022 EPSS Score
Aug 31, 2022 EPSS Score
Nov 1, 2022 EPSS Score
Mar 5, 2023 EPSS Score

References

https://ubuntu.com/security/CVE-2020-7237 third-party-advisory
https://github.com/Cacti/cacti/issues/3201 third-party-advisory
https://www.cve.org/CVERecord?id=CVE-2020-7237 third-party-advisory

Open in Interactive Console →