CVE-2014-4002

Multiple cross-site scripting (XSS) vulnerabilities in Cacti 0.8.8b allow remote attackers to...

4.3 MediumFix available

CVE-2014-4002 is a medium vulnerability (CVSS 4.3) in Cacti, published June 29, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.10%, the 81st percentile. Fixed in cacti 0.8.8b+dfsg-6.

What does this mean?

Severity: 4.3 MediumCVSS 2.0, NVD
Exploit chance: 2.10%EPSS, 81st percentile
Exploitation: None knownNot on CISA’s or ENISA’s lists
Fixed in: 0.8.8b+dfsg-6cacti +6 more

Description

Multiple cross-site scripting (XSS) vulnerabilities in Cacti 0.8.8b allow remote attackers to inject arbitrary web script or HTML via the (1) drp_action parameter to cdef.php, (2) data_input.php, (3) data_queries.php, (4) data_sources.php, (5) data_templates.php, (6) graph_templates.php, (7) graphs.php, (8) host.php, or (9) host_templates.php or the (10) graph_template_input_id or (11) graph_template_id parameter to graph_templates_inputs.php.

Exploit likelihood

2.10%Up 0.7 points since Feb 4, 2022

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`cacti` Debian:12	before 0.8.8b+dfsg-6	0.8.8b+dfsg-6
`cacti` Debian:13	before 0.8.8b+dfsg-6	0.8.8b+dfsg-6
`cacti` Debian:14	before 0.8.8b+dfsg-6	0.8.8b+dfsg-6
`cacti` Debian:7 From an advisory covering 6 CVEs	before 0.8.8a+dfsg-5+deb7u3, plus listed versions 0.8.8a+dfsg-50.8.8a+dfsg-5+deb7u10.8.8a+dfsg-5+deb7u2	0.8.8a+dfsg-5+deb7u3
`cacti` Mageia:4 From an advisory covering 5 CVEs	before 0.8.8b-3.1.mga4	0.8.8b-3.1.mga4
`cacti` Ubuntu:14.04:LTS	before 0.8.8b+dfsg-5ubuntu0.1, plus listed versions 0.8.8b+dfsg-30.8.8b+dfsg-5	0.8.8b+dfsg-5ubuntu0.1
`cacti` openSUSE:Tumbleweed From an advisory covering 18 CVEs	before 0.8.8h-1.2	0.8.8h-1.2

What each source reports

NVD Score used4.3

Record: CVE-2014-4002
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness: CWE-79
Updated: 2026-11-02

CVE ListNo score

Record: CVE-2014-4002
Updated: 2026-11-02

EUVDEUVD-2014-3934No score

Record: EUVD-2014-3934
Updated: 2026-11-03

GitHub AdvisoriesGHSA-fc89-v9fm-mhccNo score

Multiple cross-site scripting (XSS) vulnerabilities in Cacti 0.8.8b allow remote attackers to...

Record: GHSA-fc89-v9fm-mhcc
Weakness: CWE-79
Updated: 2026-11-02

OSVNo score

Record: CVE-2014-4002
Updated: 2026-11-02

OSVDEBIAN-CVE-2014-4002No score

Record: DEBIAN-CVE-2014-4002
Updated: 2026-11-02

OSVMGASA-2014-0302No score

Updated cacti package fixes security vulnerabilities

Multiple security issues (cross-site scripting, cross-site request forgery, SQL injections, missing input sanitising) have been found in Cacti (CVE-2014-2326, CVE-2014-2328, CVE-2014-2708, CVE-2014-2709, CVE-2014-4002).

Record: MGASA-2014-0302
Updated: 2026-11-02

OSVopenSUSE-SU-2024:10084-1No score

cacti-0.8.8h-1.2 on GA media

These are all security issues fixed in the cacti-0.8.8h-1.2 package on the GA media of openSUSE Tumbleweed.