Approved changes feed: RSS · Atom
cpe:2.3:a:cacti:cacti:1.3.0:*:*:*:*:*:*:*
part: a version: 1.3.0 update: *
| Vendor | Cacti (e6763402-5d6e-5742-a2a8-4d1f80e2547b) |
|---|---|
| Product | Cacti (7f9724ce-de8d-5e88-b014-4015b431cbe4) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2024-29895 |
vulnerable | 2026-06-08 06:33:29.505799 |
Cacti command injection in cmd_realtime.php
CRITICAL (10)
Cacti provides an operational monitoring and fault management framework. A command injection vulnerability on the 1.3.x DEV branch allows any unauthenticated user to execute arbitrary command on the server when `register_argc_argv` option of PHP is `On`. In `cmd_realtime.php` line 119, the `$poller_id` used as part of the command execution is sourced from `$_SERVER['argv']`, which can be controlled by URL when `register_argc_argv` option of PHP is `On`. And this option is `On` by default in many environments such as the main PHP Docker image for PHP. Commit 53e8014d1f082034e0646edc6286cde3800c683d contains a patch for the issue, but this commit was reverted in commit 99633903cad0de5ace636249de16f77e57a3c8fc.
Published: 2024-05-13T14:33:27.594Z
Updated: 2024-08-02T01:17:58.192Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.