{"id":"CVE-2014-2327","aliases":["DEBIAN-CVE-2014-2327","DSA-2970-1","EUVD-2014-2364","GHSA-w6fq-c949-4cc3","UBUNTU-CVE-2014-2327","openSUSE-SU-2024:10084-1"],"status":"published","title":"Cross-site request forgery (CSRF) vulnerability in Cacti 0.8.7g, 0.8.8b, and earlier allows...","description":"Cross-site request forgery (CSRF) vulnerability in Cacti 0.8.7g, 0.8.8b, and earlier allows remote attackers to hijack the authentication of users for unspecified commands, as demonstrated by requests that (1) modify binary files, (2) modify configurations, or (3) add arbitrary users.","severity":{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02288,"percentile":0.83309,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-352"],"published":"2014-04-23T14:00:00Z","modified":"2026-10-23T15:47:30Z","fixes":[{"ecosystem":"Debian:12","package":"cacti","fixed_in":["0.8.8b+dfsg-6"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"cacti","fixed_in":["0.8.8b+dfsg-6"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"cacti","fixed_in":["0.8.8b+dfsg-6"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"cacti","fixed_in":["0.8.8b+dfsg-5ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.8b+dfsg-6"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.8b+dfsg-6"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.8b+dfsg-6"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.8a+dfsg-5+deb7u3"}]}],"versions":["0.8.8a+dfsg-5","0.8.8a+dfsg-5+deb7u1","0.8.8a+dfsg-5+deb7u2"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.8b+dfsg-5ubuntu0.1"}]}],"versions":["0.8.8b+dfsg-3","0.8.8b+dfsg-5"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.8h-1.2"}]}],"bundled":18}],"products":[{"vendor":"cacti","product":"cacti"},{"vendor":"debian","product":"debian_linux"},{"vendor":"opensuse","product":"opensuse"}],"references":[{"url":"http://jvn.jp/en/jp/JVN55076671/index.html","tags":["third-party-advisory","x_refsource_JVN","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=742768","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Third Party Advisory","advisory","report"]},{"url":"http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-002239.html","tags":["third-party-advisory","x_refsource_JVNDB","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://www.securityfocus.com/archive/1/531588","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","Third Party Advisory","VDB Entry","advisory","report"]},{"url":"http://secunia.com/advisories/59203","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-updates/2015-03/msg00034.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.securityfocus.com/bid/66392","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://www.debian.org/security/2014/dsa-2970","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"https://security.gentoo.org/glsa/201509-03","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-2327"},{"url":"https://github.com/advisories/GHSA-w6fq-c949-4cc3"},{"url":"https://security-tracker.debian.org/tracker/CVE-2014-2327","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2014-2327","tags":["report"]},{"url":"http://bugs.cacti.net/view.php?id=2432","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-2327","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2013-5588","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-5589","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-2326","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-2327","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-2328","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-2708","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-2709","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-4002","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-5025","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-5026","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-4342","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-4634","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8369","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8377","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8604","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2313","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3172","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3659","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2014-2327","description":"Cross-site request forgery (CSRF) vulnerability in Cacti 0.8.7g, 0.8.8b, and earlier allows remote attackers to hijack the authentication of users for unspecified commands, as demonstrated by requests that (1) modify binary files, (2) modify configurations, or (3) add arbitrary users.","status":"published","published":"2014-04-23T14:00:00Z","modified":"2024-08-06T10:14:25.026Z","updated_at":"2026-11-02T14:33:43.883586Z"}],"euvd":[{"id":"EUVD-2014-2364","description":"Cross-site request forgery (CSRF) vulnerability in Cacti 0.8.7g, 0.8.8b, and earlier allows remote attackers to hijack the authentication of users for unspecified commands, as demonstrated by requests that (1) modify binary files, (2) modify configurations, or (3) add arbitrary users.","status":"published","published":"2014-04-23T14:00:00Z","modified":"2024-08-06T10:14:25Z","updated_at":"2026-11-03T01:57:14.847023Z"}],"ghsa":[{"id":"GHSA-w6fq-c949-4cc3","title":"Cross-site request forgery (CSRF) vulnerability in Cacti 0.8.7g, 0.8.8b, and earlier allows...","description":"Cross-site request forgery (CSRF) vulnerability in Cacti 0.8.7g, 0.8.8b, and earlier allows remote attackers to hijack the authentication of users for unspecified commands, as demonstrated by requests that (1) modify binary files, (2) modify configurations, or (3) add arbitrary users.","status":"published","published":"2022-05-14T01:48:53Z","modified":"2023-02-02T05:04:35Z","cwes":["CWE-352"],"updated_at":"2026-11-02T14:51:54.365671Z"}],"nvd":[{"id":"CVE-2014-2327","description":"Cross-site request forgery (CSRF) vulnerability in Cacti 0.8.7g, 0.8.8b, and earlier allows remote attackers to hijack the authentication of users for unspecified commands, as demonstrated by requests that (1) modify binary files, (2) modify configurations, or (3) add arbitrary users.","status":"published","published":"2014-04-23T15:55:03.39Z","modified":"2026-06-17T00:06:25.127Z","cvss":[{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:02:54.082915Z"}],"osv":[{"id":"CVE-2014-2327","description":"Cross-site request forgery (CSRF) vulnerability in Cacti 0.8.7g, 0.8.8b, and earlier allows remote attackers to hijack the authentication of users for unspecified commands, as demonstrated by requests that (1) modify binary files, (2) modify configurations, or (3) add arbitrary users.","status":"published","published":"2014-04-23T15:55:03Z","modified":"2026-04-10T03:43:41.017882Z","updated_at":"2026-11-02T15:43:59.361892Z"},{"id":"DEBIAN-CVE-2014-2327","description":"Cross-site request forgery (CSRF) vulnerability in Cacti 0.8.7g, 0.8.8b, and earlier allows remote attackers to hijack the authentication of users for unspecified commands, as demonstrated by requests that (1) modify binary files, (2) modify configurations, or (3) add arbitrary users.","status":"published","published":"2014-04-23T15:55:03.39Z","modified":"2026-10-23T15:47:30.760915954Z","updated_at":"2026-11-02T15:45:26.134753Z"},{"id":"DSA-2970-1","title":"cacti - security update","status":"published","published":"2014-06-29T00:00:00Z","modified":"2026-03-09T01:19:10.977088Z","updated_at":"2026-11-02T15:46:15.843838Z"},{"id":"openSUSE-SU-2024:10084-1","title":"cacti-0.8.8h-1.2 on GA media","description":"These are all security issues fixed in the cacti-0.8.8h-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:05:58.398225Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"UBUNTU-CVE-2014-2327","description":"Cross-site request forgery (CSRF) vulnerability in Cacti 0.8.7g, 0.8.8b, and earlier allows remote attackers to hijack the authentication of users for unspecified commands, as demonstrated by requests that (1) modify binary files, (2) modify configurations, or (3) add arbitrary users.","status":"published","published":"2014-04-23T15:55:00Z","modified":"2025-07-16T07:17:15.125533Z","updated_at":"2026-11-02T15:54:07.855521Z"}]}}