Unscored severity · published Apr 22, 2003
CVE-2002-1477
graphs.php in Cacti before 0.6.8 allows remote authenticated Cacti administrators to execute arbitrary commands via shell metacharacters in the title during edit mode
–
CVSS
2.3%
EPSS
No
On KEV
Description
graphs.php in Cacti before 0.6.8 allows remote authenticated Cacti administrators to execute arbitrary commands via shell metacharacters in the title during edit mode.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.3% · higher than 83% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CA
Cacti · The Cacti Group
0.5; 0.6; 0.6.1; 0.6.2; 0.6.3; 0.6.4; +4 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2002-1477
CVE.org
https://www.cve.org/CVERecord?id=CVE-2002-1477
Exploit
http://archives.neohapsis.com/archives/bugtraq/2002-09/0028.html
Patch
http://www.debian.org/security/2002/dsa-164
Patch
http://www.iss.net/security_center/static/10048.php
URL Repurposed
http://www.knights-of-the-routing-table.org/advisories/krt_001_20020903_cacti.txt
www.securityfocus.com
http://www.securityfocus.com/bid/5627
More from Cacti
–
CVE-2007-3113
Cacti 0.8.6i, and possibly other versions, allows remote authenticated users to cause a denial of service (CPU consumption) via a large value of the (1) graph_height or (2)…
–
CVE-2007-3112
graph_image.php in Cacti 0.8.6i, and possibly other versions, allows remote authenticated users to cause a denial of service (CPU consumption) via a large value of the (1)…
–
CVE-2006-6799
SQL injection vulnerability in Cacti 0.8.6i and earlier, when register_argc_argv is enabled, allows remote attackers to execute arbitrary SQL commands via the (1) second or (2)…
–
CVE-2006-0146
The server.php test script in ADOdb for PHP before 4.70, as used in multiple products including (1) Mantis, (2) PostNuke, (3) Moodle, (4) Cacti, (5) Xaraya, (6) PHPOpenChat, (7)…
–
CVE-2006-0147
Dynamic code evaluation vulnerability in tests/tmssql.php test script in ADOdb for PHP before 4.70, as used in multiple products including (1) Mantis, (2) PostNuke, (3) Moodle,…