Fluid Attacks Database

Description

graph_realtime.php in Cacti 1.2.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in a cookie, if a guest user has the graph real-time privilege.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
debian 11	cacti	>=0 <1.2.10+ds1-1	1.2.10+ds1-1
debian 13	cacti	>=0 <1.2.10+ds1-1	1.2.10+ds1-1
debian 12	cacti	>=0 <1.2.10+ds1-1	1.2.10+ds1-1
debian 14	cacti	>=0 <1.2.10+ds1-1	1.2.10+ds1-1

Aliases

1. CVE-2020-88132. NVD-2020-88133. OSV-DEBIAN-2020-88134. OSV-2020-88135. SECURITY-TRACKER-CVE-2020-8813

References

1. https://vulncheck.com/cve/CVE-2020-88132. https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-8813.yaml3. https://github.com/mhaskar/CVE-2020-8813

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.