Bug 724348 (CVE-2020-13230, CVE-2020-13231)

Summary:	<net-analyzer/cacti-1.2.11: Multiple vulnerabilities (CVE-2020-{13230,13231})
Product:	Gentoo Security	Reporter:	Sam James <sam>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	trivial
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
Whiteboard:	B4 [noglsa cve]
Package list:		Runtime testing required:	---
Bug Depends on:	720918
Bug Blocks:

Description Sam James archtester

2020-05-20 15:40:02 UTC

* CVE-2020-13230

Description:
"In Cacti before 1.2.11, disabling a user account does not immediately invalidate any permissions granted to that account (e.g., permission to view logs)."

* CVE-2020-13231

Description:
"In Cacti before 1.2.11, auth_profile.php?action=edit allows CSRF for an admin email change."

Comment 1 Sam James archtester

2020-05-20 15:41:26 UTC

Nothing for maintainers to do. Just here in case of GLSA for anything newer in