[Bug 1173090] New: VUL-1: CVE-2020-14295: cacti: SQL injection issue in color.php allows an admin to inject SQL via the filter parameter. This can lead to remote command execution because the product accepts stacked queries
http://bugzilla.opensuse.org/show_bug.cgi?id=1173090 Bug ID: 1173090 Summary: VUL-1: CVE-2020-14295: cacti: SQL injection issue in color.php allows an admin to inject SQL via the filter parameter. This can lead to remote command execution because the product accepts stacked queries Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.1 Hardware: Other URL: https://smash.suse.de/issue/261720/ OS: Other Status: NEW Severity: Minor Priority: P5 - None Component: Security Assignee: Andreas.Stieger@gmx.de Reporter: rfrohl@suse.com QA Contact: security-team@suse.de Found By: Security Response Team Blocker: --- CVE-2020-14295 A SQL injection issue in color.php in Cacti 1.2.12 allows an admin to inject SQL via the filter parameter. This can lead to remote command execution because the product accepts stacked queries. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14295 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14295 https://github.com/Cacti/cacti/issues/3622 -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=1173090 http://bugzilla.opensuse.org/show_bug.cgi?id=1173090#c1 --- Comment #1 from Andreas Stieger <Andreas.Stieger@gmx.de> --- Also.... https://github.com/Cacti/cacti/issues/3544 Cacti is affected by CVE-2020-11022 and CVE-2020-11023 https://github.com/Cacti/cacti/issues/3549 Several XSS Vulnerabilities https://github.com/Cacti/cacti/pull/3582 Update PHPMailer to version 6.1.6 with fix for CVE-2020-13625 -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=1173090 http://bugzilla.opensuse.org/show_bug.cgi?id=1173090#c3 --- Comment #3 from Andreas Stieger <Andreas.Stieger@gmx.de> --- from https://www.cacti.net/release_notes.php?version=1.2.13 security#3544: jQuery XSS vulnerabilities require vendor package update (CVE-2020-11022 / CVE-2020-11023) security#3549: Lack of escaping on some pages can lead to XSS exposure security#3582: Update PHPMailer to 6.1.6 (CVE-2020-13625) security#3622: SQL Injection vulnerability due to input validation failure when editing colors (CVE-2020-14295) security#3628: Lack of escaping on template import can lead to XSS exposure -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=1173090 http://bugzilla.opensuse.org/show_bug.cgi?id=1173090#c8 Andreas Stieger <Andreas.Stieger@gmx.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution|--- |FIXED --- Comment #8 from Andreas Stieger <Andreas.Stieger@gmx.de> --- done -- You are receiving this mail because: You are on the CC list for the bug.
participants (1)
-
bugzilla_noreply＠suse.com