CVE-2014-2328

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

lib/graph_export.php in Cacti 0.8.7g, 0.8.8b, and earlier allows remote authenticated users to execute arbitrary commands via shell metacharacters in unspecified vectors.

Metrics

CVSS 2.0 6.5/10AV:N/AC:L/Au:S/C:P/I:P/A:P

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://bugs.cacti.net/view.php?id=2433Issue Tracking, Vendor Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2014-April/131821.htmlThird Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2014-April/131842.htmlThird Party Advisory
http://lists.opensuse.org/opensuse-updates/2015-03/msg00034.htmlThird Party Advisory
http://secunia.com/advisories/59203Third Party Advisory
http://svn.cacti.net/viewvc?view=rev&revision=7442Issue Tracking, Patch, Vendor Advisory
http://www.debian.org/security/2014/dsa-2970Third Party Advisory
http://www.securityfocus.com/archive/1/531588Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/66387Third Party Advisory, VDB Entry
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=742768Issue Tracking, Third Party Advisory
https://security.gentoo.org/glsa/201509-03Third Party Advisory
http://bugs.cacti.net/view.php?id=2433Issue Tracking, Vendor Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2014-April/131821.htmlThird Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2014-April/131842.htmlThird Party Advisory
http://lists.opensuse.org/opensuse-updates/2015-03/msg00034.htmlThird Party Advisory
http://secunia.com/advisories/59203Third Party Advisory
http://svn.cacti.net/viewvc?view=rev&revision=7442Issue Tracking, Patch, Vendor Advisory
http://www.debian.org/security/2014/dsa-2970Third Party Advisory
http://www.securityfocus.com/archive/1/531588Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/66387Third Party Advisory, VDB Entry
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=742768Issue Tracking, Third Party Advisory
https://security.gentoo.org/glsa/201509-03Third Party Advisory

Timeline

Published: Apr 23, 2014
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-23293.5Multiple cross-site scripting (XSS) vulnerabilities in Check_MK before 1.2.2p3 and 1.2.3x before 1.2.3i5 allow remote authenticated users to CVE-2014-23306.8Multiple cross-site request forgery (CSRF) vulnerabilities in the Multisite GUI in Check_MK before 1.2.5i2 allow remote attackers to hijack CVE-2014-23318.5Check_MK 1.2.2p2, 1.2.2p3, and 1.2.3i5 allows remote authenticated users to execute arbitrary Python code via a crafted rules.mk file in a s CVE-2014-23325.5Check_MK before 1.2.2p3 and 1.2.3x before 1.2.3i5 allows remote authenticated users to delete arbitrary files via a request to an unspecifie CVE-2014-23332.6Cross-site scripting (XSS) vulnerability in the Lazyest Gallery plugin before 1.1.21 for WordPress allows remote attackers to inject arbitra CVE-2014-23344.3Multiple cross-site scripting (XSS) vulnerabilities in the Web User Interface in Fortinet FortiAnalyzer before 5.0.7 allow remote attackers CVE-2014-23354.3Multiple cross-site scripting (XSS) vulnerabilities in the Web User Interface in Fortinet FortiManager before 5.0.7 allow remote attackers t CVE-2014-23364.3Multiple cross-site scripting (XSS) vulnerabilities in the Web User Interface in Fortinet FortiManager before 5.0.7 and FortiAnalyzer before CVE-2014-23386.4IKEv2 in strongSwan 4.0.7 before 5.1.3 allows remote attackers to bypass authentication by rekeying an IKE_SA during (1) initiation or (2) r CVE-2014-23396.5Multiple SQL injection vulnerabilities in bbs/ajax.autosave.php in GNUboard 5.x and possibly earlier allow remote authenticated users to exe CVE-2014-23406.8Cross-site request forgery (CSRF) vulnerability in the XCloner plugin before 3.1.1 for WordPress allows remote attackers to hijack the authe CVE-2014-23416.8Session fixation vulnerability in CubeCart before 5.2.9 allows remote attackers to hijack web sessions via the PHPSESSID parameter.