CVE-2020-7237

Name	CVE-2020-7237
Description	Cacti 1.2.8 allows Remote Code Execution (by privileged users) via shell metacharacters in the Performance Boost Debug Log field of poller_automation.php. OS commands are executed when a new poller cycle begins. The attacker must be authenticated, and must have access to modify the Performance Settings of the product.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	949997

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
cacti (PTS)	bookworm, bookworm (security)	1.2.24+ds1-1+deb12u5	fixed
	trixie	1.2.30+ds1-1	fixed
	forky, sid	1.2.31+ds1-3	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Debian Bugs
cacti	source	jessie	(not affected)
cacti	source	stretch	(not affected)
cacti	source	buster	1.2.2+ds1-2+deb10u3
cacti	source	(unstable)	1.2.9+ds1-1	949997

Notes

[stretch] - cacti <not-affected> (Boost plugin not shipped)
[jessie] - cacti <not-affected> (Vulnerable code introduced later)
https://github.com/Cacti/cacti/issues/3201
https://github.com/Cacti/cacti/commit/5010719dbd160198be3e07bb994cf237e3af1308