CVE-2009-4112
NoneCVSS
—
EPSS
11.5%
Published
Nov 30, 2009
CISA due date
—
The record
Cacti 0.8.7e and earlier allows remote authenticated administrators to gain privileges by modifying the "Data Input Method" for the "Linux - Get Memory Usage" setting to contain arbitrary commands.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:10 | cacti | 0 | 1.2.1+ds1-1 |
| Debian:11 | cacti | 0 | 1.2.1+ds1-1 |
| Debian:12 | cacti | 0 | 1.2.1+ds1-1 |
| Debian:13 | cacti | 0 | 1.2.1+ds1-1 |
| SUSE:Package Hub 12 | cacti | 0 | 1.2.11-5.1 |
| SUSE:Package Hub 12 | cacti-spine | 0 | 1.2.11-2.1 |
| SUSE:Package Hub 15 SP1 | cacti | 0 | 1.2.9-bp151.4.3.1 |
| SUSE:Package Hub 15 SP1 | cacti | 0 | 1.2.11-bp151.4.6.1 |
| SUSE:Package Hub 15 SP1 | cacti-spine | 0 | 1.2.9-bp151.4.3.1 |
| SUSE:Package Hub 15 SP1 | cacti-spine | 0 | 1.2.11-bp151.4.6.1 |
| openSUSE:Leap 15.1 | cacti | 0 | 1.2.9-lp151.3.3.1 |
| openSUSE:Leap 15.1 | cacti | 0 | 1.2.11-5.1 |
| openSUSE:Leap 15.1 | cacti-spine | 0 | 1.2.9-lp151.3.3.1 |
| openSUSE:Leap 15.1 | cacti-spine | 0 | 1.2.11-2.1 |
| openSUSE:Tumbleweed | cacti | 0 | 1.2.18-1.2 |
Related vulnerabilities
- CVE-2006-0146 The server.php test script in ADOdb for PHP before 4.70, as used in multiple products… Also affects cacti
- CVE-2006-0147 Dynamic code evaluation vulnerability in tests/tmssql.php test script in ADOdb for PHP… Also affects cacti
- CVE-2005-1526 PHP remote file inclusion vulnerability in config_settings.php in Cacti before 0.8.6e… Also affects cacti
- CVE-2005-1524 PHP file inclusion vulnerability in top_graph_header.php in Cacti 0.8.6d and possibly… Also affects cacti
- CVE-2025-24367 Cacti is an open source performance and fault management framework. Also affects cacti
- CVE-2024-54146 Cacti is an open source performance and fault management framework. Also affects cacti
- CVE-2024-48910 DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. Also affects cacti
- CVE-2024-47875 DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. Also affects cacti