CVE-2020-13231: CSRF
In Cacti before 1.2.11, authprofile.php?action=edit allows CSRF for an admin email change.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/cactito a version that resolves this vulnerability.Fixed in 1.1.38+ds1-1ubuntu0.1~esm1 - Upgrade
Upgrade
ubuntu/cactito a version that resolves this vulnerability.Fixed in 1.2.10+ds1-1ubuntu1+esm1
Event History
Frequently Asked Questions
What is CVE-2020-13231?
CVE-2020-13231 is a vulnerability in Cacti before version 1.2.11 that allows CSRF for an admin email change.
How severe is CVE-2020-13231?
CVE-2020-13231 has a severity score of 6.5, which is considered medium.
How does CVE-2020-13231 affect Cacti?
CVE-2020-13231 affects Cacti versions before 1.2.11.
How can I fix CVE-2020-13231?
To fix CVE-2020-13231, you should update to Cacti version 1.2.11 or later.
Are there any references I can check for more information on CVE-2020-13231?
Yes, you can find more information on CVE-2020-13231 at the following references: - GitHub issue: https://github.com/Cacti/cacti/issues/3342 - Cacti release: https://github.com/Cacti/cacti/releases/tag/release%2F1.2.11 - Fedora Project announcement: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ICJMWSY77IIGZYR6FE6NAQZFBO42VECO/