CVE-2020-7237 Command injection in n/a
Authenticated privileged users can execute arbitrary OS commands via shell metacharacters in the Performance Boost Debug Log field.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-7237?
CVE-2020-7237 is a high-severity command injection vulnerability in Cacti Cacti, published on 20 Jan 2020. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Cacti 1.2.8 allows Remote Code Execution (by privileged users) via shell metacharacters in the Performance Boost Debug Log field of poller_automation.php. OS commands are executed when a new poller cycle begins. The attacker must be authenticated, and must have access to modify the Performance Settings of the product.
Weakness: CWE-78
Which versions are affected by CVE-2020-7237?
It affects 1 product.
Products include Cacti Cacti.
How do I fix CVE-2020-7237?
Upgrade to a fixed version.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2020-7237 being exploited?
There is no known exploitation of CVE-2020-7237 in the wild and no public exploit code.
Other vulnerabilities in Cacti Cacti
- CVE-2022-46169 Cacti Command Injection
- CVE-2026-39893 Cacti: Pre-authentication SQL injection via rfilter RLIKE clause in graph_view.php
- CVE-2026-39938 Cacti: Unauthenticated RCE on Graph Image
- CVE-2026-39955 Cacti has Pre-Authentication SQL Injection via unanchored FILTER_VALIDATE_REGEXP in graph_view.php
- CVE-2023-39361 Unauthenticated SQL Injection in graph_view.php in Cacti
Sources
Also known as DEBIAN-CVE-2020-7237, GHSA-4wfp-xfpc-fxcp, UBUNTU-CVE-2020-7237.