Open Audit

Vendor:

First CVE: May 10, 2018 · Active for 8 years

16

Total CVEs

More Total CVEs than 93% of tracked products

3.2

Avg CVEs / Year

Higher CVE frequency than 84% of tracked products

7.2

Avg CVSS

Higher Avg CVSS than 48% of tracked products

0.0%

KEV Rate

Bottom 1%

Trends Over Time

The number and severity of CVEs published that impact Open Audit over time

Volume of CVEsAvg CVSS Base Score

First CVE

May 10, 2018

8 years ago

Most Recent CVE

Jan 3, 2022

1,667 days ago

CVE Severity & Scoring

Open Audit16 CVEs

56%

31%

13%

All CVEs353,240 CVEs

45%

40%

11%

MediumHighCritical

Attack Vector

Local0 (0.0%)

Network16 (100.0%)

Unknown0 (0.0%)

Physical0 (0.0%)

Adjacent Network0 (0.0%)

Attack Complexity

Low15 (93.8%)

High1 (6.3%)

Unknown0 (0.0%)

User Interaction

None9 (56.3%)

Unknown0 (0.0%)

Required7 (43.8%)

Privileges Required

Low10 (62.5%)

High0 (0.0%)

None6 (37.5%)

Unknown0 (0.0%)

Top CVEs

Signals from CVEs in this product scope (16 CVEs).

16 CVEs · Highest risk first

CVE	Published	CVSS	Risk	KEV	Exploit
CVE-2020-8813HIGH graph_realtime.php in Cacti 1.2.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in a cookie, if a guest user has the graph real-time privilege.	Feb 22, 2020	8.8	80	NO	YES
CVE-2018-14493MEDIUM Cross-site scripting (XSS) vulnerability in the Groups Page in Open-Audit Community 2.2.6 allows remote attackers to inject arbitrary web script or HTML via the group name.	Jul 25, 2018	6.1	52	NO	YES
CVE-2020-11943HIGH An issue was discovered in Open-AudIT 3.2.2. There is Arbitrary file upload.	Apr 29, 2020	8.8	33	NO	NO
CVE-2021-44916MEDIUM Opmantek Open-AudIT Community 4.2.0 (Fixed in 4.3.0) is affected by a Cross Site Scripting (XSS) vulnerability. If a bad value is passed to the routine via a URL, malicious JavaScr	Dec 20, 2021	6.1	32	NO	YES
CVE-2020-12078HIGH An issue was discovered in Open-AudIT 3.3.1. There is shell metacharacter injection via attributes to an open-audit/configuration/ URI. An attacker can exploit this by adding an ex	Apr 28, 2020	8.8	32	NO	NO
CVE-2021-40612CRITICAL An issue was discovered in Opmantek Open-AudIT after 3.5.0. Without authentication, a vulnerability in code_igniter/application/controllers/util.php allows an attacker perform comm	Dec 22, 2021	9.8	31	NO	NO
CVE-2019-16293HIGH The Create Discoveries feature of Open-AudIT before 3.2.0 allows an authenticated attacker to execute arbitrary OS commands via a crafted value for a URL field.	Sep 13, 2019	8.8	28	NO	NO
CVE-2018-11124MEDIUM Cross-site scripting (XSS) vulnerability in Attributes functionality in Open-AudIT Community edition before 2.2.2 allows remote attackers to inject arbitrary web script or HTML via	Jul 6, 2018	5.4	28	NO	YES
CVE-2018-10314MEDIUM Cross-site scripting (XSS) vulnerability in Open-AudIT Community 2.2.0 allows remote attackers to inject arbitrary web script or HTML via a crafted name of a component, as demonstr	May 10, 2018	5.4	27	NO	YES
CVE-2021-44674MEDIUM An information exposure issue has been discovered in Opmantek Open-AudIT 4.2.0. The vulnerability allows an authenticated attacker to read file outside of the restricted directory.	Jan 3, 2022	6.5	24	NO	NO

View all 16 CVEs →

Exploit Exposure

Signals from CVEs in this product scope (16 CVEs).

CISA KEV

0 CVEs

0.0% of CVEs· Bottom 1%

Metasploit

0 CVEs

0.0% of CVEs· Bottom 1%

Nuclei

1 CVE

6.2% of CVEs· 97th percentile

ExploitDB

6 CVEs

37.5% of CVEs· 89th percentile

Social Chatter

Signals from CVEs in this product scope (16 CVEs).

Media Mentions

Signals from CVEs in this product scope (16 CVEs).

Top CNAs Publishing CVEs For Open Audit

Top CWEs

Versions

Version	CVE Count	Avg CVSS	Avg EPSS	Exploits
4.2.0	1	6.5	1.0%	0
4.0.1	1	6.1	0.8%	0
3.3.1	2	8.8	41.9%	1
3.3.0	1	5.4	2.6%	1
3.2.2	3	9.1	9.9%	0
2.2.7	1	5.4	0.7%	0
2.2.6	1	6.1	40.4%	1
2.2.0	1	5.4	1.9%	1