CVE-2014-4000

HIGH

Cacti < 1.0.0 - Authenticated PHP Object Injection via Unserialize

Title source: llm
STIX 2.1

Description

Cacti before 1.0.0 allows remote authenticated users to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted serialized object, related to calling unserialize(stripslashes()).

References (4)

Core 4
Core References
Issue Tracking, Third Party Advisory x_refsource_confirm
https://security-tracker.debian.org/tracker/CVE-2014-4000
Issue Tracking, Release Notes, Vendor Advisory x_refsource_confirm
https://forums.cacti.net/viewtopic.php?f=4&t=56794
Issue Tracking, Third Party Advisory vendor-advisory x_refsource_gentoo
https://security.gentoo.org/glsa/201711-10
Issue Tracking, Release Notes, Vendor Advisory x_refsource_confirm
https://www.cacti.net/release_notes_1_0_0.php

Scores

CVSS v3 8.8
EPSS 0.0167
EPSS Percentile 73.9%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-94
Status published
Products (1)
cacti/cacti < 1.0.0
Published Nov 15, 2017
Tracked Since Feb 18, 2026