PT-2014-4875 · Cacti+1 · Cacti+1

Published 2014-04-10 · Updated 2024-06-15 · CVE-2014-2708

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Cacti versions 0.8.7g, 0.8.8b, and earlier

Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via several parameters in the graph xport.php file, including graph start, graph end, graph height, graph width, graph nolegend, print source, local graph id, or rra id.

Recommendations For Cacti versions 0.8.7g and 0.8.8b, update to a version later than 0.8.8b to resolve the issue. For Cacti versions earlier than 0.8.7g, update to a version later than 0.8.7g to resolve the issue. As a temporary workaround, consider restricting access to the graph xport.php file until a patch is available. Avoid using the parameters graph start, graph end, graph height, graph width, graph nolegend, print source, local graph id, or rra id in the graph xport.php file until the issue is resolved.

Fix

RCE

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

ALT-PU-2014-1594

ALT-PU-2016-1467

CVE-2014-2708

DSA-2970-1

MGASA-2014-0302

OPENSUSE-SU-2024:10084-1

Affected Products

Alt Linux

Cacti

References · 91

• http://debian.org/security/2014/dsa-2970 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4002 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:10084-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-2708 · Security Note
• https://bdu.fstec.ru/vul/2016-01051 · Security Note
• https://errata.altlinux.org/ALT-PU-2016-1467 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-2708 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5261 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-2708 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2014-2708 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2014-1594 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2014-April/131842.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5588 · Security Note
• https://debian.org/security/2014/dsa-2970 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4634 · Security Note