CVE-2010-1645

Cacti < 0.8.7f - Authenticated Remote Code Execution via FQDN or Vertical Label Field

Title source: llm
STIX 2.1

Description

Cacti before 0.8.7f, as used in Red Hat High Performance Computing (HPC) Solution and other products, allows remote authenticated administrators to execute arbitrary commands via shell metacharacters in (1) the FQDN field of a Device or (2) the Vertical Label field of a Graph Template.

References (10)

Core 10
Core References
Various Sources x_refsource_confirm
http://svn.cacti.net/viewvc?view=rev&revision=5784
Various Sources x_refsource_confirm
http://www.cacti.net/release_notes_0_8_7f.php
Various Sources x_refsource_confirm
http://svn.cacti.net/viewvc?view=rev&revision=5778
Vendor Advisory vendor-advisory x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDVSA-2010:160
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/41041
Vendor Advisory vendor-advisory x_refsource_redhat
https://rhn.redhat.com/errata/RHSA-2010-0635.html
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2010/2132
Various Sources x_refsource_confirm
http://svn.cacti.net/viewvc?view=rev&revision=5782
Issue Tracking x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=609115

Scores

EPSS 0.0280
EPSS Percentile 84.8%

Details

CWE
CWE-20
Status published
Products (37)
cacti/cacti 0.5
cacti/cacti 0.6
cacti/cacti 0.6.1
cacti/cacti 0.6.2
cacti/cacti 0.6.3
cacti/cacti 0.6.4
cacti/cacti 0.6.5
cacti/cacti 0.6.6
cacti/cacti 0.6.7
cacti/cacti 0.6.8
... and 27 more
Published Aug 23, 2010
Tracked Since Feb 18, 2026