Description
Cross-site request forgery (CSRF) vulnerability in Cacti 0.8.7g, 0.8.8b, and earlier allows remote attackers to hijack the authentication of users for unspecified commands, as demonstrated by requests that (1) modify binary files, (2) modify configurations, or (3) add arbitrary users.
References (9)
Core 9
Core References
Third Party Advisory, VDB Entry third-party-advisory
x_refsource_jvn
http://jvn.jp/en/jp/JVN55076671/index.html
Issue Tracking, Third Party Advisory x_refsource_confirm
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=742768
Third Party Advisory, VDB Entry third-party-advisory
x_refsource_jvndb
http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-002239.html
Third Party Advisory, VDB Entry mailing-list
x_refsource_bugtraq
http://www.securityfocus.com/archive/1/531588
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/59203
Third Party Advisory vendor-advisory
x_refsource_suse
http://lists.opensuse.org/opensuse-updates/2015-03/msg00034.html
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/66392
Third Party Advisory vendor-advisory
x_refsource_debian
http://www.debian.org/security/2014/dsa-2970
Third Party Advisory vendor-advisory
x_refsource_gentoo
https://security.gentoo.org/glsa/201509-03
Scores
EPSS
0.0230
EPSS Percentile
81.2%
Details
CWE
CWE-352
Status
published
Products (5)
cacti/cacti
0.8.7 - 0.8.7g
debian/debian_linux
7.0
debian/debian_linux
8.0
opensuse/opensuse
13.1
opensuse/opensuse
13.2
Published
Apr 23, 2014
Tracked Since
Feb 18, 2026