Cacti 0.8.7e and earlier allows remote authenticated administrators to gain...

Vulnerability Description

Cacti 0.8.7e and earlier allows remote authenticated administrators to gain privileges by modifying the "Data Input Method" for the "Linux - Get Memory Usage" setting to contain arbitrary commands.

References

• http://www.securityfocus.com/archive/1/508129/100/0/threaded
• http://archives.neohapsis.com/archives/fulldisclosure/2009-11/0292.html
• http://www.openwall.com/lists/oss-security/2009/11/30/2
• http://www.openwall.com/lists/oss-security/2009/11/26/1
• https://exchange.xforce.ibmcloud.com/vulnerabilities/54473
• http://www.securityfocus.com/bid/37137
• http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00001.html
• http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00005.html
• http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00042.html
• http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00048.html