CVE-2024-29895

Scores

EPSS

0.932high93.2%
0%20%40%60%80%100%

Percentile: 93.2%

CVSS

10.0critical3.x
0246810

CVSS Score: 10.0/10

All CVSS Scores

CVSS 3.x
10.0

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Description

Cacti provides an operational monitoring and fault management framework. A command injection vulnerability on the 1.3.x DEV branch allows any unauthenticated user to execute arbitrary command on the server when register_argc_argv option of PHP is On. In cmd_realtime.php line 119, the $poller_id used as part of the command execution is sourced from $_SERVER['argv'], which can be controlled by URL when register_argc_argv option of PHP is On. And this option is On by default in many environments such as the main PHP Docker image for PHP. Commit 53e8014d1f082034e0646edc6286cde3800c683d contains a patch for the issue, but this commit was reverted in commit 99633903cad0de5ace636249de16f77e57a3c8fc.

Scaner-VS 7 — a modern vulnerability management solution

Uses this database for vulnerability detection. High-speed search, cross-platform, advanced configuration audit, and flexible filtering. Suitable for organizations of any size.
Learn more about Scaner-VS 7

Sources

debianubuntu

CWEs

CWE-77

Related Vulnerabilities

Exploits

Exploit ID: CVE-2024-29895

Source: github-poc

URL: https://github.com/apaz-dev/CVE-2024-29895

Vulnerable Software (5)

Type: Configuration

Product: cacti

Operating System: debian

Trait:
{  "unaffected": true}

Source: debian

Type: Configuration

Product: cacti

Operating System: ubuntu focal 20.04

Trait:
{  "unfixed": true}

Source: ubuntu

Type: Configuration

Product: cacti

Operating System: ubuntu mantic 23.10

Trait:
{  "unfixed": true}

Source: ubuntu

Type: Configuration

Product: cacti

Operating System: ubuntu oracular 24.10

Trait:
{  "unfixed": true}

Source: ubuntu

Type: Configuration

Product: cacti

Operating System: ubuntu plucky 25.04

Trait:
{  "unfixed": true}

Source: ubuntu

End of list