Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2014-2327

Cross-site request forgery (CSRF) vulnerability in Cacti 0.8.7g, 0.8.8b, and earlier allows remote attackers to hijack the authentication of users for unspecified commands, as demonstrated by requests that (1) modify binary files, (2) modify configurations, or (3) add arbitrary users.

Published

2014-04-23T15:55:03.390

Last Modified

2025-04-12T10:46:40.837

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 6.8 (MEDIUM)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Access Vector: NETWORK
Access Complexity: MEDIUM
Authentication: NONE
Confidentiality Impact: PARTIAL
Integrity Impact: PARTIAL
Availability Impact: PARTIAL

Exploitability Score

8.6

Impact Score

6.4

Weaknesses

Type: Primary
CWE-352

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	cacti	cacti	≤ 0.8.7g	Yes
Application	cacti	cacti	≤ 0.8.8b	Yes
Operating System	debian	debian_linux	7.0	Yes
Operating System	debian	debian_linux	8.0	Yes
Operating System	opensuse	opensuse	13.1	Yes
Operating System	opensuse	opensuse	13.2	Yes

References

http://jvn.jp/en/jp/JVN55076671/index.html Third Party Advisory, VDB Entry ([email protected])
http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-002239.html Third Party Advisory, VDB Entry ([email protected])
http://lists.opensuse.org/opensuse-updates/2015-03/msg00034.html Third Party Advisory ([email protected])
http://secunia.com/advisories/59203 Third Party Advisory ([email protected])
http://www.debian.org/security/2014/dsa-2970 Third Party Advisory ([email protected])
http://www.securityfocus.com/archive/1/531588 Third Party Advisory, VDB Entry ([email protected])
http://www.securityfocus.com/bid/66392 Third Party Advisory, VDB Entry ([email protected])
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=742768 Issue Tracking, Third Party Advisory ([email protected])
https://security.gentoo.org/glsa/201509-03 Third Party Advisory ([email protected])
http://jvn.jp/en/jp/JVN55076671/index.html Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-002239.html Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
http://lists.opensuse.org/opensuse-updates/2015-03/msg00034.html Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/59203 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.debian.org/security/2014/dsa-2970 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.securityfocus.com/archive/1/531588 Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
http://www.securityfocus.com/bid/66392 Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=742768 Issue Tracking, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://security.gentoo.org/glsa/201509-03 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)