CVE-2014-2327

Severity: medium (CVSS 6.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2014-04-23 · updated 2026-06-17
Weakness: CWE-352

Description

Cross-site request forgery (CSRF) vulnerability in Cacti 0.8.7g, 0.8.8b, and earlier allows remote attackers to hijack the authentication of users for unspecified commands, as demonstrated by requests that (1) modify binary files, (2) modify configurations, or (3) add arbitrary users.

Affected products

cacti: from 0.8.7 through 0.8.7g; from 0.8.8 through 0.8.8b
Debian Linux: 7.0, 8.0
Opensuse: 13.1, 13.2

References

http://jvn.jp/en/jp/JVN55076671/index.html
http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-002239.html
http://lists.opensuse.org/opensuse-updates/2015-03/msg00034.html
http://secunia.com/advisories/59203
http://www.debian.org/security/2014/dsa-2970
http://www.securityfocus.com/archive/1/531588
http://www.securityfocus.com/bid/66392
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=742768
https://security.gentoo.org/glsa/201509-03
http://jvn.jp/en/jp/JVN55076671/index.html
http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-002239.html
http://lists.opensuse.org/opensuse-updates/2015-03/msg00034.html

Get alerted when CVE-2014-2327 or the next vulnerability affects your stack