CVE-2014-2327

MediumCVSS 6.8/10Last modified Jun 17, 2026

Description

Cross-site request forgery (CSRF) vulnerability in Cacti 0.8.7g, 0.8.8b, and earlier allows remote attackers to hijack the authentication of users for unspecified commands, as demonstrated by requests that (1) modify binary files, (2) modify configurations, or (3) add arbitrary users.

Metrics

CVSS 2.0 6.8/10AV:N/AC:M/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://jvn.jp/en/jp/JVN55076671/index.htmlThird Party Advisory, VDB Entry
http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-002239.htmlThird Party Advisory, VDB Entry
http://lists.opensuse.org/opensuse-updates/2015-03/msg00034.htmlThird Party Advisory
http://secunia.com/advisories/59203Third Party Advisory
http://www.debian.org/security/2014/dsa-2970Third Party Advisory
http://www.securityfocus.com/archive/1/531588Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/66392Third Party Advisory, VDB Entry
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=742768Issue Tracking, Third Party Advisory
https://security.gentoo.org/glsa/201509-03Third Party Advisory
http://jvn.jp/en/jp/JVN55076671/index.htmlThird Party Advisory, VDB Entry
http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-002239.htmlThird Party Advisory, VDB Entry
http://lists.opensuse.org/opensuse-updates/2015-03/msg00034.htmlThird Party Advisory
http://secunia.com/advisories/59203Third Party Advisory
http://www.debian.org/security/2014/dsa-2970Third Party Advisory
http://www.securityfocus.com/archive/1/531588Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/66392Third Party Advisory, VDB Entry
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=742768Issue Tracking, Third Party Advisory
https://security.gentoo.org/glsa/201509-03Third Party Advisory

Timeline

Published: Apr 23, 2014
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-23286.5lib/graph_export.php in Cacti 0.8.7g, 0.8.8b, and earlier allows remote authenticated users to execute arbitrary commands via shell metachar CVE-2014-23293.5Multiple cross-site scripting (XSS) vulnerabilities in Check_MK before 1.2.2p3 and 1.2.3x before 1.2.3i5 allow remote authenticated users to CVE-2014-23306.8Multiple cross-site request forgery (CSRF) vulnerabilities in the Multisite GUI in Check_MK before 1.2.5i2 allow remote attackers to hijack CVE-2014-23318.5Check_MK 1.2.2p2, 1.2.2p3, and 1.2.3i5 allows remote authenticated users to execute arbitrary Python code via a crafted rules.mk file in a s CVE-2014-23325.5Check_MK before 1.2.2p3 and 1.2.3x before 1.2.3i5 allows remote authenticated users to delete arbitrary files via a request to an unspecifie CVE-2014-23332.6Cross-site scripting (XSS) vulnerability in the Lazyest Gallery plugin before 1.1.21 for WordPress allows remote attackers to inject arbitra CVE-2014-23344.3Multiple cross-site scripting (XSS) vulnerabilities in the Web User Interface in Fortinet FortiAnalyzer before 5.0.7 allow remote attackers CVE-2014-23354.3Multiple cross-site scripting (XSS) vulnerabilities in the Web User Interface in Fortinet FortiManager before 5.0.7 allow remote attackers t CVE-2014-23364.3Multiple cross-site scripting (XSS) vulnerabilities in the Web User Interface in Fortinet FortiManager before 5.0.7 and FortiAnalyzer before CVE-2014-23386.4IKEv2 in strongSwan 4.0.7 before 5.1.3 allows remote attackers to bypass authentication by rekeying an IKE_SA during (1) initiation or (2) r CVE-2014-23396.5Multiple SQL injection vulnerabilities in bbs/ajax.autosave.php in GNUboard 5.x and possibly earlier allow remote authenticated users to exe CVE-2014-23406.8Cross-site request forgery (CSRF) vulnerability in the XCloner plugin before 3.1.1 for WordPress allows remote attackers to hijack the authe