CVE-2020-7058

Published: Jan 15, 2020Modified: Nov 21, 2024

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

data_input.php in Cacti 1.2.8 allows remote code execution via a crafted Input String to Data Collection -> Data Input Methods -> Unix -> Ping Host. NOTE: the vendor has stated "This is a false alarm.

Affected (1)

Products: Cacti: Cacti

Cacti

1 product

Cacti

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Cacti Cacti	Version 1.2.8

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (2)

https://github.com/Cacti/cacti/issues/3186

Source: cve@mitre.org

ExploitIssue TrackingThird Party Advisory

https://github.com/Cacti/cacti/issues/3186

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitIssue TrackingThird Party Advisory

Timeline

No history available yet.