# openSUSE-SU-2022:10170-1: Security update for cacti, cacti-spine > An attacker can inject malicious scripts via graph creation, potentially leading to code execution or account takeover in Cacti. - **Severity:** Not scored - **Exploited in the wild:** Not known - **Login needed:** Any signed-in user - **Attackable:** Over the internet - **Victim action needed:** A user has to click or open something - **Fix available:** Yes - **Published:** 30 Oct 2022 ## What is openSUSE-SU-2022:10170-1? openSUSE-SU-2022:10170-1 is a cross-site scripting vulnerability in cacti, published on 30 Oct 2022. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link. ### Official description This update for cacti, cacti-spine fixes the following issues: cacti-spine 1.2.22, delivering a number of bug fixes: * When polling time is exceed, spine does not always exit as expected * Spine logging at `-V 5` includes an extra line feed * Incorrect SNMP responses can cause spine to crash * Properly handle devices that timeout responding to the Extended Uptime * MariaDB can cause spine to abort prematurely despite error handling * Spine should log the error time when exiting via signal cacti-spine 1.2.21: * Disable DES if Net-SNMP doesn't have it cacti 1.2.22, providing one security fix, a number of bug fixes and a collection of improvements: * When creating new graphs, cross site injection is possible (boo#1203952) * When creating user from template, multiple Domain FullName and Mail are not propagated * Nectar Aggregate 95th emailed report broken * Boost may not find archive tables correctly * Users may be unable to change their password when forced during a login * Net-SNMP Memory Graph Template has Wrong GPRINT * Search in tree view unusable on larger installations * Increased bulk insert size to avoid partial inserts and potential data loss. * Call to undefined function boost_debug in Cacti log * When no guest template is set, login cookies are not properly set * Later RRDtool releases do not need to check last_update time * Regex filters are not always long enough * Domains based LDAP and AD Fullname and Email not auto-populated * Cacti polling and boost report the wrong number of Data Sources when Devices are disabled * When editing Graph Template Items there are cases where VDEF's are hidden when they should be shown * Database SSL setting lacks default value * Update default path cacti under *BSD by xmacan * Web Basic authentication not creating template user * Unable to change the Heartbeat of a Data Source Profile * Tree Search Does Not Properly Search All Trees * When structured paths are setup, RRDfiles may not always be created when possible * When parsing the logs, caching would help speed up processing * Deprecation warnings when attempting real-time Graphs with PHP8.1 * Custom Timespan is lost when clicking other tree branches * Non device based Data Sources not being polled * When Resource XML file inproperly formatted, graph creation can fail with errors * Update code style to support PHP 8 requirements * None' shows all graphs * Realtime popup window experiences issues on some browsers * Auth settings do not always properly reflect the options selected by ddb4github * MySQL can cause cacti to become stalled due to locking issues * Boost process can get hung under rare conditions until the poller times out * Exporting graphs under PHP 8 can cause errors * Host table has wrong default for disabled and deleted columns * RRD storage paths do not scale properly * When importing, make it possible to only import certain components * Update change_device script to include new features by bmfmancini * Make help pages use latest online version wherever possible * Cacti should show PHP INI locations during install * Detect PHP INI values that are different in the INI vs running config * Added Gradient Color support for AREA charts by thurban * Update CDEF functions for RRDtool * When boost is running, it's not clear which processes are running and how long they have to complete cacti 1.2.21: * Add a CLI script to install/enable/disable/uninstall plugins * Add log message when purging DS stats and poller repopulate * A collection of bug fixes ## Which versions are affected by openSUSE-SU-2022:10170-1? | Package | Ecosystem | Affected | Fixed in | | --- | --- | --- | --- | | `cacti` | SUSE:Package Hub 12 | All versions | 1.2.22-bp154.2.3.1 | | `cacti-spine` | SUSE:Package Hub 12 | All versions | 1.2.22-bp154.2.3.1 | | `cacti` | SUSE:Package Hub 15 SP3 | All versions | 1.2.22-bp154.2.3.1 | | `cacti-spine` | SUSE:Package Hub 15 SP3 | All versions | 1.2.22-bp154.2.3.1 | | `cacti` | SUSE:Package Hub 15 SP4 | All versions | 1.2.22-bp154.2.3.1 | | `cacti-spine` | SUSE:Package Hub 15 SP4 | All versions | 1.2.22-bp154.2.3.1 | | `cacti` | openSUSE:Leap 15.3 | All versions | 1.2.22-bp154.2.3.1 | | `cacti-spine` | openSUSE:Leap 15.3 | All versions | 1.2.22-bp154.2.3.1 | | `cacti` | openSUSE:Leap 15.4 | All versions | 1.2.22-bp154.2.3.1 | | `cacti-spine` | openSUSE:Leap 15.4 | All versions | 1.2.22-bp154.2.3.1 | ## How do I fix openSUSE-SU-2022:10170-1? Upgrade to a fixed version. ## Is openSUSE-SU-2022:10170-1 being exploited? There is no known exploitation of openSUSE-SU-2022:10170-1 in the wild and no public exploit code. ## Fix prompt for AI coding agents ```text Check this codebase for openSUSE-SU-2022:10170-1 and fix it if it is affected. What it is: openSUSE-SU-2022:10170-1 is a cross-site scripting vulnerability in cacti, published on 30 Oct 2022. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link. Exploitation: There is no known exploitation of openSUSE-SU-2022:10170-1 in the wild and no public exploit code. Affected product: cacti. No package-level version data is available, so check the vendor advisory linked from the reference page. Task: 1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies. 2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it. 3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead. 4. Run the tests and summarise what changed and why. 5. If nothing in the project is affected, say so and change nothing. Reference: https://insights.sbomify.com/openSUSE-SU-2022-10170-1/ (Markdown: https://insights.sbomify.com/openSUSE-SU-2022-10170-1/index.md) ``` ## Sources - OSV: https://osv.dev/vulnerability/openSUSE-SU-2022:10170-1 --- From sbomify Insights: https://insights.sbomify.com/openSUSE-SU-2022-10170-1/ Summaries are generated and may contain mistakes; the official description above is the record.