CVE-2002-1479

5 documents5 sources
Severity
4.6MEDIUM
EPSS
0.1%
top 69.31%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
THE Cacti Group Cacti
Timeline
PublishedApr 22
Latest updateApr 30

Description

Cacti before 0.6.8 stores a MySQL username and password in plaintext in config.php, which has world-readable permissions, which allows local users to modify databases as the Cacti user and possibly gain privileges.

CVSS vector

AV:L/AC:L/C:P/I:P/A:PExploitability: 3.9 | Impact: 6.4

Affected Packages2 packages

▶Debiancacti< 0.6.8-1+3
▶NVDthe_cacti_group/cacti10 versions+9

Patches

Patch: archives.neohapsis.com ↗Patch: www.iss.net ↗Patch: www.securityfocus.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-389p-g5q7-wj2f: Cacti before 0↗2022-04-30
▶
CVEList
CVE-2002-1479: Cacti before 0↗2004-09-01
▶
OSV
CVE-2002-1479: Cacti before 0↗2003-04-22
▶

📋Vendor Advisories

1
Debian
CVE-2002-1479: cacti - Cacti before 0.6.8 stores a MySQL username and password in plaintext in config.p...↗2002
▶