CVE-2014-5261

Cacti < 0.8.8b - Remote Code Execution via Font Size Parameter

Title source: llm
STIX 2.1

Description

The graph settings script (graph_settings.php) in Cacti 0.8.8b and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in a font size, related to the rrdtool commandline in lib/rrd.php.

References (8)

Core 8
Core References
Third Party Advisory vendor-advisory x_refsource_gentoo
https://security.gentoo.org/glsa/201607-05
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2014/dsa-3007
Issue Tracking x_refsource_misc
https://bugzilla.redhat.com/show_bug.cgi?id=1127165
Mailing List mailing-list x_refsource_mlist
http://seclists.org/oss-sec/2014/q3/351
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/95292
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/69213
Mailing List mailing-list x_refsource_mlist
http://seclists.org/oss-sec/2014/q3/386

Scores

EPSS 0.1077
EPSS Percentile 95.3%

Details

CWE
CWE-94
Status published
Products (13)
cacti/cacti 0.8.6e
cacti/cacti 0.8.7
cacti/cacti 0.8.7a
cacti/cacti 0.8.7b
cacti/cacti 0.8.7c
cacti/cacti 0.8.7d
cacti/cacti 0.8.7e
cacti/cacti 0.8.7f
cacti/cacti 0.8.7g
cacti/cacti 0.8.7i
... and 3 more
Published Aug 22, 2014
Tracked Since Feb 18, 2026