| Vulnerability Name: | CVE-2010-2092 (CCN-58668) |
| Assigned: | 2010-05-13 |
| Published: | 2010-05-13 |
| Updated: | 2012-02-16 |
| Summary: | SQL injection vulnerability in graph.php in Cacti 0.8.7e and earlier allows remote attackers to execute arbitrary SQL commands via a crafted rra_id parameter in a GET request in conjunction with a valid rra_id value in a POST request or a cookie, which causes the POST or cookie value to bypass the validation routine, but inserts the $_GET value into the resulting query.
|
| CVSS v3 Severity: | 7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)| Exploitability Metrics: | Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None | | Scope: | Scope (S): Unchanged
| | Impact Metrics: | Confidentiality (C): Low
Integrity (I): Low
Availibility (A): Low |
|
| CVSS v2 Severity: | 7.5 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
7.1 High (Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P/E:H/RL:U/RC:UR)| Exploitability Metrics: | Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None | | Impact Metrics: | Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial |
7.5 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
7.1 High (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P/E:H/RL:U/RC:UR)| Exploitability Metrics: | Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
| | Impact Metrics: | Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial |
|
| Vulnerability Type: | CWE-89
|
| Vulnerability Consequences: | Data Manipulation |
| References: | Source: MITRE
Type: CNA
CVE-2010-2092
Source: CCN
Type: MOPS-2010-023
Cacti Graph Viewer SQL
Source: MISC
Type: Exploit
http://php-security.org/2010/05/13/mops-2010-023-cacti-graph-viewer-sql-injection-vulnerability/index.html
Source: CCN
Type: SA41041
Red Hat High Performance Computing (HPC) Solution Multiple Vulnerabilities
Source: SECUNIA
Type: UNKNOWN
41041
Source: CONFIRM
Type: UNKNOWN
http://www.cacti.net/changelog.php
Source: CCN
Type: Cacti Web site
Cacti
Source: DEBIAN
Type: UNKNOWN
DSA-2060
Source: DEBIAN
Type: DSA-2060
cacti -- insufficient input sanitization
Source: CCN
Type: OSVDB ID: 64964
Cacti graph.php rra_id Parameter SQL Injection
Source: CCN
Type: BID-40149
Cacti 'rra_id' Parameter SQL Injection Vulnerability
Source: CCN
Type: BID-42575
Cacti Cross Site Scripting and HTML Injection Vulnerabilities
Source: VUPEN
Type: UNKNOWN
ADV-2010-2132
Source: XF
Type: UNKNOWN
cacti-rraid-sql-injection(58668)
Source: REDHAT
Type: UNKNOWN
RHSA-2010:0635
|
| Vulnerable Configuration: | Configuration 1:
cpe:/a:cacti:cacti:0.5:-:*:*:*:*:*:*OR cpe:/a:cacti:cacti:0.6:*:*:*:*:*:*:*OR cpe:/a:cacti:cacti:0.6.1:*:*:*:*:*:*:*OR cpe:/a:cacti:cacti:0.6.2:*:*:*:*:*:*:*OR cpe:/a:cacti:cacti:0.6.3:*:*:*:*:*:*:*OR cpe:/a:cacti:cacti:0.6.4:*:*:*:*:*:*:*OR cpe:/a:cacti:cacti:0.6.5:*:*:*:*:*:*:*OR cpe:/a:cacti:cacti:0.6.6:*:*:*:*:*:*:*OR cpe:/a:cacti:cacti:0.6.7:*:*:*:*:*:*:*OR cpe:/a:cacti:cacti:0.6.8:*:*:*:*:*:*:*OR cpe:/a:cacti:cacti:0.6.8a:*:*:*:*:*:*:*OR cpe:/a:cacti:cacti:0.8:*:*:*:*:*:*:*OR cpe:/a:cacti:cacti:0.8.1:*:*:*:*:*:*:*OR cpe:/a:cacti:cacti:0.8.2:*:*:*:*:*:*:*OR cpe:/a:cacti:cacti:0.8.2a:*:*:*:*:*:*:*OR cpe:/a:cacti:cacti:0.8.3:*:*:*:*:*:*:*OR cpe:/a:cacti:cacti:0.8.3a:*:*:*:*:*:*:*OR cpe:/a:cacti:cacti:0.8.4:*:*:*:*:*:*:*OR cpe:/a:cacti:cacti:0.8.5:*:*:*:*:*:*:*OR cpe:/a:cacti:cacti:0.8.5a:*:*:*:*:*:*:*OR cpe:/a:cacti:cacti:0.8.6:*:*:*:*:*:*:*OR cpe:/a:cacti:cacti:0.8.6a:*:*:*:*:*:*:*OR cpe:/a:cacti:cacti:0.8.6b:*:*:*:*:*:*:*OR cpe:/a:cacti:cacti:0.8.6c:*:*:*:*:*:*:*OR cpe:/a:cacti:cacti:0.8.6d:*:*:*:*:*:*:*OR cpe:/a:cacti:cacti:0.8.6f:*:*:*:*:*:*:*OR cpe:/a:cacti:cacti:0.8.6g:*:*:*:*:*:*:*OR cpe:/a:cacti:cacti:0.8.6h:*:*:*:*:*:*:*OR cpe:/a:cacti:cacti:0.8.6i:*:*:*:*:*:*:*OR cpe:/a:cacti:cacti:0.8.6j:*:*:*:*:*:*:*OR cpe:/a:cacti:cacti:0.8.6k:*:*:*:*:*:*:*OR cpe:/a:cacti:cacti:0.8.7:*:*:*:*:*:*:*OR cpe:/a:cacti:cacti:0.8.7a:*:*:*:*:*:*:*OR cpe:/a:cacti:cacti:0.8.7b:*:*:*:*:*:*:*OR cpe:/a:cacti:cacti:0.8.7c:*:*:*:*:*:*:*OR cpe:/a:cacti:cacti:0.8.7d:*:*:*:*:*:*:*OR cpe:/a:cacti:cacti:*:*:*:*:*:*:*:* (Version <= 0.8.7e)
Configuration CCN 1:
cpe:/a:cacti:cacti:0.8.6:*:*:*:*:*:*:*OR cpe:/a:cacti:cacti:0.8.6d:*:*:*:*:*:*:*OR cpe:/a:cacti:cacti:0.8.6c:*:*:*:*:*:*:*OR cpe:/a:cacti:cacti:0.8.6e:*:*:*:*:*:*:*OR cpe:/a:cacti:cacti:0.8.6g:*:*:*:*:*:*:*OR cpe:/a:cacti:cacti:0.8.6i:*:*:*:*:*:*:*OR cpe:/a:cacti:cacti:0.8.6j:*:*:*:*:*:*:*OR cpe:/a:cacti:cacti:0.8.6h:*:*:*:*:*:*:*OR cpe:/a:cacti:cacti:0.8.6f:*:*:*:*:*:*:*OR cpe:/a:cacti:cacti:0.8.6b:*:*:*:*:*:*:*OR cpe:/a:cacti:cacti:0.8.6a:*:*:*:*:*:*:*OR cpe:/a:cacti:cacti:0.8.7a:*:*:*:*:*:*:*OR cpe:/a:cacti:cacti:0.8.6k:*:*:*:*:*:*:*OR cpe:/a:cacti:cacti:0.8.7e:*:*:*:*:*:*:*OR cpe:/a:cacti:cacti:0.8.7b:*:*:*:*:*:*:*OR cpe:/a:cacti:cacti:0.8.7c:*:*:*:*:*:*:*OR cpe:/a:cacti:cacti:0.8.7d:*:*:*:*:*:*:*AND cpe:/o:debian:debian_linux:5.0:*:*:*:*:*:*:*
 Denotes that component is vulnerable |
| Oval Definitions |
|
| BACK |