There are 2 open security issues in buster.
2 issues left for the package maintainer to handle:
- CVE-2020-25706:
(needs triaging)
A cross-site scripting (XSS) vulnerability exists in templates_import.php (Cacti 1.2.13) due to Improper escaping of error message during template import preview in the xml_path field
- CVE-2020-8813:
(needs triaging)
graph_realtime.php in Cacti 1.2.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in a cookie, if a guest user has the graph real-time privilege.
You can find information about how to handle these issues in the security team's documentation.
![[bug history graph]](https://qa.debian.org/data/bts/graphs/c/cacti.png){kind=link}