CVE-2014-5025: cacti Cross-site Scripting
CVSS: 3.5v2.0LowModified
AliasesUBUNTU-CVE-2014-5025DEBIAN-CVE-2014-5025
Published 20-10-2014Last modified 06-08-2024
Vulnerability summary
CVE-2014-5025 is a low (CVSS 3.5) Cross-site Scripting vulnerability in cacti. EPSS estimates a 1.78% chance of exploitation in the next 30 days, higher than 78% of scored vulnerabilities. 2 public exploits are recorded.
CVSS score
3.5/10
010
Low · v2.0 (NVD)EPSS score
1.78%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits2reference
Advisory lineage
Upstream 0 · Downstream 4 · Related 1Timeline
- 20-10-2014PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
Cross-site scripting (XSS) vulnerability in data_sources.php in Cacti 0.8.8b allows remote authenticated users with console access to inject arbitrary web script or HTML via the name_cache parameter in a ds_edit action.
CVSS metrics
1 score · 1 source · 1 versionLow 3.5Preferred score · NVD (NIST)
AV:N/AC:M/Au:S/C:N/I:P/A:NSourcesSingle source
EPSS trend
Probability
1.78%
Chance of exploitation in the next 30 days
Percentile
78%
Versus all other CVEs
30-day change
0.00 pp
From 1.78% on 21-09-2026
21-09-202621-10-2026
EPSS score1.78%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundExploit Reference (bugs.cacti.net)
Maturity: unknown
Exploit Reference (openwall.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Debian2 products
- cacti< 0.8.8b+dfsg-7
- debian_linuxEOL7.0
Cacti1 product
- cacti0.8.8b
Opensuse1 product
- opensuseEOL13.1 | 13.2
Ubuntu1 product
- cacti< 0.8.8b+dfsg-5ubuntu0.1
4 vendors · 5 products
References
10 links
- www.openwall.com/lists/oss-security/2014/07/22/9Mailing ListX Refsource MLISTExploitThird Party Advisory
- lists.opensuse.org/opensuse-updates/2015-03/msg00034.htmlVendor AdvisoryX Refsource SUSEThird Party Advisory