PT-2020-13386 · Cacti+3 · Cacti+3

Sh0Lt · Published 2020-05-20 · Updated 2025-01-24 · CVE-2020-13230

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cacti versions prior to 1.2.11

Description The issue arises when a user account is disabled in Cacti, but the permissions granted to that account are not immediately invalidated. This means that the disabled account may still have access to certain features, such as viewing logs.

Recommendations For versions prior to 1.2.11, update to version 1.2.11 or later to resolve the issue. As a temporary workaround, consider manually revoking permissions from disabled user accounts until a patch is applied.

Exploit

Fix

Improper Preservation of Permissions

Weakness Enumeration

CWE-281

Related Identifiers

ALT-PU-2020-3394

ALT-PU-2020-3430

ALT-PU-2025-1813

CVE-2020-13230

DLA-2965-1

USN-5214-1

Affected Products

Alt Linux

Cacti

Linuxmint

Ubuntu

References · 41

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/http/cacti_filter_sqli_rce.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/cacti_pollers_sqli_rce.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/cacti_unauthenticated_cmd_injection.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/cacti_package_import_rce.rb · Exploit
• 🔥 https://github.com/Cacti/cacti/issues/3343 · Exploit
• 🔥 https://github.com/mhaskar/CVE-2020-8813 · Exploit
• 🔥 https://github.com/0xf4n9x/CVE-2022-46169 · Exploit
• 🔥 https://github.com/FredBrave/CVE-2022-46169-CACTI-1.2.22 · Exploit
• 🔥 https://github.com/sAsPeCt488/CVE-2022-46169 · Exploit
• 🔥 https://github.com/ariyaadinatha/cacti-cve-2022-46169-exploit · Exploit
• 🔥 https://github.com/deadyP00l/CVE-2022-46169 · Exploit
• 🔥 https://github.com/botfather0x0/CVE-2022-46169 · Exploit
• 🔥 https://github.com/Anthonyc3rb3ru5/CVE-2022-46169 · Exploit
• 🔥 https://github.com/c3rrberu5/CVE-2022-46169 · Exploit
• 🔥 https://github.com/thisisveryfunny/CVE-2024-25641-RCE-Automated-Exploit-Cacti-1.2.26 · Exploit