Vulnerabilities > CVE-2019-16723 - Authorization Bypass Through User-Controlled Key vulnerability in Cacti
Attack vector
NETWORK Attack complexity
LOW Privileges required
LOW Confidentiality impact
LOW Integrity impact
NONE Availability impact
NONE Summary
In Cacti through 1.2.6, authenticated users may bypass authorization checks (for viewing a graph) via a direct graph_json.php request with a modified local_graph_id parameter.
Vulnerable Configurations
Common Weakness Enumeration (CWE)
Nessus
NASL family Debian Local Security Checks NASL id DEBIAN_DSA-4604.NASL description Multiple issues have been found in cacti, a server monitoring system, potentially resulting in SQL code execution or information disclosure by authenticated users. - CVE-2019-16723 Authenticated users may bypass authorization checks for viewing a graph by submitting requests with modified local_graph_id parameters. - CVE-2019-17357 The graph administration interface insufficiently sanitizes the template_id parameter, potentially resulting in SQL injection. This vulnerability might be leveraged by authenticated attackers to perform unauthorized SQL code execution on the database. - CVE-2019-17358 The sanitize_unserialize_selected_items function (lib/functions.php) insufficiently sanitizes user input before deserializing it, potentially resulting in unsafe deserialization of user-controlled data. This vulnerability might be leveraged by authenticated attackers to influence the program control flow or cause memory corruption. last seen 2020-06-01 modified 2020-06-02 plugin id 133107 published 2020-01-21 reporter This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/133107 title Debian DSA-4604-1 : cacti - security update NASL family Fedora Local Security Checks NASL id FEDORA_2019-6BF27B45B3.NASL description - Update to 1.2.8 Release notes: https://www.cacti.net/release_notes.php?version=1.2.8 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 132329 published 2019-12-20 reporter This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/132329 title Fedora 30 : cacti / cacti-spine (2019-6bf27b45b3) NASL family SuSE Local Security Checks NASL id OPENSUSE-2020-272.NASL description This update for cacti, cacti-spine fixes the following issues : cacti-spine was updated to version 1.2.9. Security issues fixed : - CVE-2009-4112: Fixed a privilege escalation (bsc#1122535). - CVE-2018-20723: Fixed a cross-site scripting (XSS) vulnerability (bsc#1122245). - CVE-2018-20724: Fixed a cross-site scripting (XSS) vulnerability (bsc#1122244). - CVE-2018-20725: Fixed a privilege escalation that could occur under certain conditions (bsc#1122535). - CVE-2018-20726: Fixed a cross-site scripting (XSS) vulnerability (bsc#1122242). - CVE-2019-16723: Fixed an authentication bypass vulnerability. - CVE-2019-17357: Fixed a SQL injection vulnerability (bsc#1158990). - CVE-2019-17358: Fixed an unsafe deserialization in sanitize_unserialize_selected_items (bsc#1158992). - CVE-2020-7106: Fixed a potential cross-site scripting (XSS) vulnerability (bsc#1163749). - CVE-2020-7237: Fixed a remote code execution that affected privileged users via shell metacharacters in the Performance Boost Debug Log field (bsc#1161297). Non-security issues fixed : - Fixed missing packages php-json, php-ctype, and php-gd in cacti.spec (boo#1101024). - Fixed Apache2.4 and Apache2.2 runtime configuration issue (boo#1101139). last seen 2020-03-18 modified 2020-03-02 plugin id 134195 published 2020-03-02 reporter This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/134195 title openSUSE Security Update : cacti / cacti-spine (openSUSE-2020-272) NASL family Gentoo Local Security Checks NASL id GENTOO_GLSA-202003-40.NASL description The remote host is affected by the vulnerability described in GLSA-202003-40 (Cacti: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in Cacti. Please review the CVE identifiers referenced below for details. Impact : Remote attackers could execute arbitrary code or bypass intended access restrictions. Workaround : There is no known workaround at this time. last seen 2020-03-26 modified 2020-03-20 plugin id 134726 published 2020-03-20 reporter This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/134726 title GLSA-202003-40 : Cacti: Multiple vulnerabilities NASL family Fedora Local Security Checks NASL id FEDORA_2019-362F0E9710.NASL description - Update to 1.2.8 Release notes: https://www.cacti.net/release_notes.php?version=1.2.8 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 132348 published 2019-12-23 reporter This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/132348 title Fedora 31 : cacti / cacti-spine (2019-362f0e9710) NASL family SuSE Local Security Checks NASL id OPENSUSE-2020-558.NASL description This update for cacti, cacti-spine to version 1.2.11 fixes the following issues : This update is fixing multiple vulnerabilities and adding bug fixes. For more details consult the changes file. last seen 2020-05-06 modified 2020-04-29 plugin id 136073 published 2020-04-29 reporter This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/136073 title openSUSE Security Update : cacti / cacti-spine (openSUSE-2020-558) NASL family FreeBSD Local Security Checks NASL id FREEBSD_PKG_ED18AA92E4F411E9B6FA3085A9A95629.NASL description The cacti developers reports : In Cacti through 1.2.6, authenticated users may bypass authorization checks (for viewing a graph) via a direct graph_json.php request with a modified local_graph_id parameter. last seen 2020-06-01 modified 2020-06-02 plugin id 129548 published 2019-10-03 reporter This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/129548 title FreeBSD : cacti -- Authenticated users may bypass authorization checks (ed18aa92-e4f4-11e9-b6fa-3085a9a95629)
References
- https://github.com/Cacti/cacti/issues/2964
- https://www.debian.org/security/2020/dsa-4604
- https://seclists.org/bugtraq/2020/Jan/25
- http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00001.html
- http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00005.html
- https://security.gentoo.org/glsa/202003-40
- http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00042.html
- http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00048.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZSCUUCKSYVZLN3PQE7NU76AFWUGT3E2D/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZO3ROHHPKLH2JRW7ES5FYSQTWIPNVLQB/