VulnerabilityModified
CVE-2014-2327
Cross-site request forgery (CSRF) vulnerability in Cacti 0.8.7g, 0.8.8b, and earlier allows remote attackers to hijack the authentication of users for unspecified commands, as demonstrated by requests that (1) modify binary files, (2) modify…
MEDIUM 6.8EPSS 2.30%
Does this matter?
Lower severity and a low EPSS score (2.30%). Track it; it rarely justifies an emergency change on its own.
Description
Cross-site request forgery (CSRF) vulnerability in Cacti 0.8.7g, 0.8.8b, and earlier allows remote attackers to hijack the authentication of users for unspecified commands, as demonstrated by requests that (1) modify binary files, (2) modify configurations, or (3) add arbitrary users.
- CVSS 2.0
- 6.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
- EPSS
- 2.30% probability · 82th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-352
- Affected
- cacti/cacti · debian/debian linux · opensuse/opensuse
- Source
- cve@mitre.org
References
- http://jvn.jp/en/jp/JVN55076671/index.htmlThird Party Advisory, VDB Entry
- http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-002239.htmlThird Party Advisory, VDB Entry
- http://lists.opensuse.org/opensuse-updates/2015-03/msg00034.htmlThird Party Advisory
- http://secunia.com/advisories/59203Third Party Advisory
- http://www.debian.org/security/2014/dsa-2970Third Party Advisory
- http://www.securityfocus.com/archive/1/531588Third Party Advisory, VDB Entry
- http://www.securityfocus.com/bid/66392Third Party Advisory, VDB Entry
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=742768Issue Tracking, Third Party Advisory
- https://security.gentoo.org/glsa/201509-03Third Party Advisory
- http://jvn.jp/en/jp/JVN55076671/index.htmlThird Party Advisory, VDB Entry
- http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-002239.htmlThird Party Advisory, VDB Entry
- http://lists.opensuse.org/opensuse-updates/2015-03/msg00034.htmlThird Party Advisory
- http://secunia.com/advisories/59203Third Party Advisory
- http://www.debian.org/security/2014/dsa-2970Third Party Advisory
- http://www.securityfocus.com/archive/1/531588Third Party Advisory, VDB Entry
- http://www.securityfocus.com/bid/66392Third Party Advisory, VDB Entry
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=742768Issue Tracking, Third Party Advisory
- https://security.gentoo.org/glsa/201509-03Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.