CVE-2013-1435: Code Injection
Published Aug 23, 2013
·Updated
(1) snmp.php and (2) rrd.php in Cacti before 0.8.8b allows remote attackers to execute arbitrary commands via shell metacharacters in unspecified vectors.
Affected Software
33 affected components
Cacti Cacti=0.8
Cacti Cacti=0.8.1
Cacti Cacti=0.8.2
Cacti Cacti=0.8.2a
Cacti Cacti=0.8.3
Cacti Cacti=0.8.3a
Cacti Cacti=0.8.4
Cacti Cacti=0.8.5
Cacti Cacti=0.8.5a
Cacti Cacti=0.8.6
Cacti Cacti=0.8.6a
Cacti Cacti=0.8.6b
Cacti Cacti=0.8.6c
Cacti Cacti=0.8.6d
Cacti Cacti=0.8.6e
Cacti Cacti=0.8.6f
Cacti Cacti=0.8.6g
Cacti Cacti=0.8.6h
Cacti Cacti=0.8.6i
Cacti Cacti=0.8.6j
Cacti Cacti=0.8.6k
Cacti Cacti=0.8.7
Cacti Cacti=0.8.7a
Cacti Cacti=0.8.7b
Cacti Cacti=0.8.7c
Cacti Cacti=0.8.7d
Cacti Cacti=0.8.7e
Cacti Cacti=0.8.7f
Cacti Cacti=0.8.7g
Cacti Cacti=0.8.7h
Cacti Cacti=0.8.7i
Cacti Cacti=0.8.8
Cacti Cacti=0.8.8a
Remediation
Patch Available
Event History
Aug 23, 2013
CVE Published
via MITRE·04:00 PM
Data Sourced
via MITRE·04:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2013-1435?
CVE-2013-1435 is rated as a medium severity vulnerability due to its potential for arbitrary command execution.
2
How do I fix CVE-2013-1435?
To fix CVE-2013-1435, upgrade Cacti to version 0.8.8b or later.
3
Which versions of Cacti are affected by CVE-2013-1435?
CVE-2013-1435 affects Cacti versions from 0.8.0 up to, but not including, 0.8.8b.
4
What does CVE-2013-1435 allow remote attackers to do?
CVE-2013-1435 allows remote attackers to execute arbitrary commands on the affected system.
5
Is there a workaround for CVE-2013-1435?
In addition to upgrading, restricting access to the affected scripts could serve as a temporary workaround for CVE-2013-1435.