CVE-2014-2327
Cross-site request forgery (CSRF) vulnerability in Cacti 0.8.7g, 0.8.8b, and earlier allows...
Cross-site request forgery (CSRF) vulnerability in Cacti 0.8.7g, 0.8.8b, and earlier allows remote attackers to hijack the authentication of users for unspecified commands, as demonstrated by requests that (1) modify binary files, (2) modify configurations, or (3) add arbitrary users.
Exploit likelihood
What each source reports
NVD Score used
Cross-site request forgery (CSRF) vulnerability in Cacti 0.8.7g, 0.8.8b, and earlier allows remote attackers to hijack the authentication of users for unspecified commands, as demonstrated by requests that (1) modify binary files, (2) modify configurations, or (3) add arbitrary users.
- Record
CVE-2014-2327- CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-352
- Updated
- 2026-11-02
CVE List No score
Cross-site request forgery (CSRF) vulnerability in Cacti 0.8.7g, 0.8.8b, and earlier allows remote attackers to hijack the authentication of users for unspecified commands, as demonstrated by requests that (1) modify binary files, (2) modify configurations, or (3) add arbitrary users.
- Record
CVE-2014-2327- Updated
- 2026-11-02
EUVDEUVD-2014-2364 No score
Cross-site request forgery (CSRF) vulnerability in Cacti 0.8.7g, 0.8.8b, and earlier allows remote attackers to hijack the authentication of users for unspecified commands, as demonstrated by requests that (1) modify binary files, (2) modify configurations, or (3) add arbitrary users.
- Record
EUVD-2014-2364- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-w6fq-c949-4cc3 No score
Cross-site request forgery (CSRF) vulnerability in Cacti 0.8.7g, 0.8.8b, and earlier allows...
Cross-site request forgery (CSRF) vulnerability in Cacti 0.8.7g, 0.8.8b, and earlier allows remote attackers to hijack the authentication of users for unspecified commands, as demonstrated by requests that (1) modify binary files, (2) modify configurations, or (3) add arbitrary users.
- Record
GHSA-w6fq-c949-4cc3- Weakness
- CWE-352
- Updated
- 2026-11-02
OSV No score
Cross-site request forgery (CSRF) vulnerability in Cacti 0.8.7g, 0.8.8b, and earlier allows remote attackers to hijack the authentication of users for unspecified commands, as demonstrated by requests that (1) modify binary files, (2) modify configurations, or (3) add arbitrary users.
- Record
CVE-2014-2327- Updated
- 2026-11-02
OSVDEBIAN-CVE-2014-2327 No score
Cross-site request forgery (CSRF) vulnerability in Cacti 0.8.7g, 0.8.8b, and earlier allows remote attackers to hijack the authentication of users for unspecified commands, as demonstrated by requests that (1) modify binary files, (2) modify configurations, or (3) add arbitrary users.
- Record
DEBIAN-CVE-2014-2327- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10084-1 No score
cacti-0.8.8h-1.2 on GA media
These are all security issues fixed in the cacti-0.8.8h-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10084-1- Updated
- 2026-11-02
OSVUBUNTU-CVE-2014-2327 No score
Cross-site request forgery (CSRF) vulnerability in Cacti 0.8.7g, 0.8.8b, and earlier allows remote attackers to hijack the authentication of users for unspecified commands, as demonstrated by requests that (1) modify binary files, (2) modify configurations, or (3) add arbitrary users.
- Record
UBUNTU-CVE-2014-2327- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
cactiDebian:12 |
before 0.8.8b+dfsg-6 | 0.8.8b+dfsg-6 |
cactiDebian:13 |
before 0.8.8b+dfsg-6 | 0.8.8b+dfsg-6 |
cactiDebian:14 |
before 0.8.8b+dfsg-6 | 0.8.8b+dfsg-6 |
cactiDebian:7 From an advisory covering 6 CVEs |
before 0.8.8a+dfsg-5+deb7u3, plus listed versions 0.8.8a+dfsg-50.8.8a+dfsg-5+deb7u10.8.8a+dfsg-5+deb7u2 |
0.8.8a+dfsg-5+deb7u3 |
cactiUbuntu:14.04:LTS |
before 0.8.8b+dfsg-5ubuntu0.1, plus listed versions 0.8.8b+dfsg-30.8.8b+dfsg-5 |
0.8.8b+dfsg-5ubuntu0.1 |
cactiopenSUSE:Tumbleweed From an advisory covering 18 CVEs |
before 0.8.8h-1.2 | 0.8.8h-1.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-2327 is a medium vulnerability (CVSS 6.8) in Cacti, published April 23, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.29%, the 83rd percentile. Fixed in cacti 0.8.8b+dfsg-6.
References
jvn.jp/en/jp/JVN55076671/index.html
bugs.debian.org/cgi-bin/bugreport.cgi?bug=742768
jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-002239.html
securityfocus.com/archive/1/531588
secunia.com/advisories/59203
lists.opensuse.org/opensuse-updates/2015-03/msg00034.html
Show 27 moreShow less
debian.org/security/2014/dsa-2970
security.gentoo.org/glsa/201509-03
nvd.nist.gov/vuln/detail/CVE-2014-2327
github.com/advisories/GHSA-w6fq-c949-4cc3
security-tracker.debian.org/tracker/CVE-2014-2327
ubuntu.com/security/CVE-2014-2327
bugs.cacti.net/view.php?id=2432
cve.org/CVERecord?id=CVE-2014-2327
suse.com/security/cve/CVE-2013-5588