PT-2003-1215 · Cacti · Cacti

Published 2003-04-22 · Updated 2024-02-14 · CVE-2002-1479

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Cacti versions prior to 0.6.8

Description The issue allows local users to access a MySQL username and password stored in plaintext in the config.php file, which has world-readable permissions. This could enable users to modify databases as the Cacti user and potentially gain privileges.

Recommendations For versions prior to 0.6.8, update to version 0.6.8 or later to resolve the issue. As a temporary workaround, consider changing the permissions of the config.php file to restrict access to sensitive information.

Exploit

Fix

Related Identifiers

CVE-2002-1479

Affected Products

Cacti

References · 9

• 🔥 http://archives.neohapsis.com/archives/bugtraq/2002-09/0028.html · Exploit
• https://osv.dev/vulnerability/DEBIAN-CVE-2002-1479 · Vendor Advisory
• http://securityfocus.com/bid/5628 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2002-1479 · Vendor Advisory
• http://iss.net/security_center/static/10049.php · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2002-1479 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2002-1479 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1479 · Note
• http://knights-of-the-routing-table.org/advisories/krt_001_20020903_cacti.txt · Note