PT-2014-5664 · Cacti+1 · Cacti+1

Published 2014-07-03 · Updated 2024-06-15 · CVE-2014-4002

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Cacti version 0.8.8b

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. The affected parameters include drp action to various PHP files, as well as graph template input id and graph template id parameters to graph templates inputs.php. The specific PHP files affected are cdef.php, data input.php, data queries.php, data sources.php, data templates.php, graph templates.php, graphs.php, host.php, and host templates.php.

Recommendations For Cacti version 0.8.8b, consider disabling access to the affected PHP files until a patch is available. Restrict input for the drp action, graph template input id, and graph template id parameters to minimize the risk of exploitation. Avoid using these parameters in the affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

ALT-PU-2016-1467

CVE-2014-4002

DSA-2970-1

MGASA-2014-0302

OPENSUSE-SU-2024:10084-1

Affected Products

Alt Linux

Cacti

References · 84

• https://ubuntu.com/security/CVE-2014-4002 · Vendor Advisory
• http://debian.org/security/2014/dsa-2970 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4002 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:10084-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2016-01051 · Security Note
• https://errata.altlinux.org/ALT-PU-2016-1467 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5261 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5588 · Security Note
• https://debian.org/security/2014/dsa-2970 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4634 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-4002 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2014-0302.html · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2326 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3659 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2313 · Security Note