CVE-2014-2326: cacti Cross-site Scripting

CVSS: 4.3v2.0MediumModified

AliasesUBUNTU-CVE-2014-2326DEBIAN-CVE-2014-2326

Published 27-03-2014Last modified 06-08-2024

Vulnerability summary

CVE-2014-2326 is a medium (CVSS 4.3) Cross-site Scripting vulnerability in cacti. EPSS estimates a 3.22% chance of exploitation in the next 30 days, higher than 88.1% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk

28/100

0100

Medium · default modelHow is this calculated?

CVSS score

4.3/10

010

Medium · v2.0 (NVD)

EPSS score

3.22%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits1reference

Advisory lineage

Upstream 0 · Downstream 3 · Related 1

DSA-2970-1 MGASA-2014-0302 OPENSUSE-SU-2024:10084-1

Timeline

27-03-2014
PublishedVulnerability first disclosed.
06-08-2024
Last modifiedVulnerability information updated.

Description

Cross-site scripting (XSS) vulnerability in cdef.php in Cacti 0.8.7g, 0.8.8b, and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CVSS metrics

1 score · 1 source · 1 version

v2.04.3

EPSS trend

Probability

3.22%

Chance of exploitation in the next 30 days

Percentile

88%

Versus all other CVEs

30-day change

0.00 pp

From 3.22% on 21-09-2026

21-09-202621-10-2026

EPSS score

3.22%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found

referenceUnverified
Exploit Reference (packetstormsecurity.com)
Maturity: unknown

Weaknesses

CWE · root cause

CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Affected systems

Debian2 products

cacti< 0.8.8b+dfsg-4
debian_linuxEOL7.0

Cacti1 product

cacti0.8.7g

Fedoraproject1 product

fedoraEOL19 | 20

Opensuse1 product

opensuseEOL13.1 | 13.2

Ubuntu1 product

cacti< 0.8.8b+dfsg-5

5 vendors · 6 products

References

16 links

svn.cacti.net/viewvc?view=rev&revision=7443X Refsource CONFIRMIssue TrackingPatch
lists.fedoraproject.org/pipermail/package-announce/2014-April/131821.htmlVendor AdvisoryX Refsource FEDORAThird Party Advisory
bugs.debian.org/cgi-bin/bugreport.cgi?bug=742768X Refsource CONFIRMIssue TrackingThird Party Advisory
www.securityfocus.com/archive/1/531588Mailing ListX Refsource BUGTRAQThird Party AdvisoryVDB Entry
secunia.com/advisories/59203Third Party AdvisoryX Refsource SECUNIA
bugs.cacti.net/view.php?id=2431X Refsource CONFIRMIssue Tracking
lists.opensuse.org/opensuse-updates/2015-03/msg00034.htmlVendor AdvisoryX Refsource SUSEThird Party Advisory
lists.fedoraproject.org/pipermail/package-announce/2014-April/131842.htmlVendor AdvisoryX Refsource FEDORAThird Party Advisory
www.securityfocus.com/bid/66390VDB EntryX Refsource BIDThird Party Advisory
secunia.com/advisories/57647Third Party AdvisoryX Refsource SECUNIA

Show all 16 references

www.debian.org/security/2014/dsa-2970Vendor AdvisoryX Refsource DEBIANThird Party Advisory
packetstormsecurity.com/files/125849/Deutsche-Telekom-CERT-Advisory-DTC-A-20140324-001.htmlX Refsource MISCExploitThird Party AdvisoryVDB EntryREPORT
security.gentoo.org/glsa/201509-03Vendor AdvisoryX Refsource GENTOO
ubuntu.com/security/CVE-2014-2326REPORT
www.cve.org/CVERecord?id=CVE-2014-2326REPORT
security-tracker.debian.org/tracker/CVE-2014-2326Advisory

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities