Vulnerabilities > CVE-2019-17358 - Deserialization of Untrusted Data vulnerability in multiple products

047910
CVSS 8.1 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
LOW
Confidentiality impact
NONE
Integrity impact
HIGH
Availability impact
HIGH
network
low complexity
cacti
debian
opensuse
CWE-502
nessus

Summary

Cacti through 1.2.7 is affected by multiple instances of lib/functions.php unsafe deserialization of user-controlled data to populate arrays. An authenticated attacker could use this to influence object data values and control actions taken by Cacti or potentially cause memory corruption in the PHP module.

Vulnerable Configurations

Part Description Count
Application
Cacti
100
OS
Debian
1
OS
Opensuse
1

Common Weakness Enumeration (CWE)

Nessus

  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DLA-2032.NASL
    descriptionIt was discovered that there was unsafe deserialisation issue in cacti, server monitoring system system. Unsafe deserialisation of objects which can lead to abuse of the application logic, deny service or even execute arbitrary code. For Debian 8
    last seen2020-06-01
    modified2020-06-02
    plugin id131965
    published2019-12-12
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/131965
    titleDebian DLA-2032-1 : cacti security update
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-4604.NASL
    descriptionMultiple issues have been found in cacti, a server monitoring system, potentially resulting in SQL code execution or information disclosure by authenticated users. - CVE-2019-16723 Authenticated users may bypass authorization checks for viewing a graph by submitting requests with modified local_graph_id parameters. - CVE-2019-17357 The graph administration interface insufficiently sanitizes the template_id parameter, potentially resulting in SQL injection. This vulnerability might be leveraged by authenticated attackers to perform unauthorized SQL code execution on the database. - CVE-2019-17358 The sanitize_unserialize_selected_items function (lib/functions.php) insufficiently sanitizes user input before deserializing it, potentially resulting in unsafe deserialization of user-controlled data. This vulnerability might be leveraged by authenticated attackers to influence the program control flow or cause memory corruption.
    last seen2020-06-01
    modified2020-06-02
    plugin id133107
    published2020-01-21
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/133107
    titleDebian DSA-4604-1 : cacti - security update
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2020-272.NASL
    descriptionThis update for cacti, cacti-spine fixes the following issues : cacti-spine was updated to version 1.2.9. Security issues fixed : - CVE-2009-4112: Fixed a privilege escalation (bsc#1122535). - CVE-2018-20723: Fixed a cross-site scripting (XSS) vulnerability (bsc#1122245). - CVE-2018-20724: Fixed a cross-site scripting (XSS) vulnerability (bsc#1122244). - CVE-2018-20725: Fixed a privilege escalation that could occur under certain conditions (bsc#1122535). - CVE-2018-20726: Fixed a cross-site scripting (XSS) vulnerability (bsc#1122242). - CVE-2019-16723: Fixed an authentication bypass vulnerability. - CVE-2019-17357: Fixed a SQL injection vulnerability (bsc#1158990). - CVE-2019-17358: Fixed an unsafe deserialization in sanitize_unserialize_selected_items (bsc#1158992). - CVE-2020-7106: Fixed a potential cross-site scripting (XSS) vulnerability (bsc#1163749). - CVE-2020-7237: Fixed a remote code execution that affected privileged users via shell metacharacters in the Performance Boost Debug Log field (bsc#1161297). Non-security issues fixed : - Fixed missing packages php-json, php-ctype, and php-gd in cacti.spec (boo#1101024). - Fixed Apache2.4 and Apache2.2 runtime configuration issue (boo#1101139).
    last seen2020-03-18
    modified2020-03-02
    plugin id134195
    published2020-03-02
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/134195
    titleopenSUSE Security Update : cacti / cacti-spine (openSUSE-2020-272)
  • NASL familyFreeBSD Local Security Checks
    NASL idFREEBSD_PKG_86224A0426DE11EA97F2001A8C5C04B6.NASL
    descriptionThe cacti developers reports : When viewing graphs, some input variables are not properly checked (SQL injection possible). Multiple instances of lib/functions.php are affected by unsafe deserialization of user-controlled data to populate arrays. An authenticated attacker could use this to influence object data values and control actions taken by Cacti or potentially cause memory corruption in the PHP module.
    last seen2020-06-01
    modified2020-06-02
    plugin id132683
    published2020-01-07
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/132683
    titleFreeBSD : cacti -- multiple vulnerabilities (86224a04-26de-11ea-97f2-001a8c5c04b6)
  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-202003-40.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-202003-40 (Cacti: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in Cacti. Please review the CVE identifiers referenced below for details. Impact : Remote attackers could execute arbitrary code or bypass intended access restrictions. Workaround : There is no known workaround at this time.
    last seen2020-03-26
    modified2020-03-20
    plugin id134726
    published2020-03-20
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/134726
    titleGLSA-202003-40 : Cacti: Multiple vulnerabilities
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2020-558.NASL
    descriptionThis update for cacti, cacti-spine to version 1.2.11 fixes the following issues : This update is fixing multiple vulnerabilities and adding bug fixes. For more details consult the changes file.
    last seen2020-05-06
    modified2020-04-29
    plugin id136073
    published2020-04-29
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/136073
    titleopenSUSE Security Update : cacti / cacti-spine (openSUSE-2020-558)

References