CVE-2014-2709

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

lib/rrd.php in Cacti 0.8.7g, 0.8.8b, and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in unspecified parameters.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.fedoraproject.org/pipermail/package-announce/2014-April/131821.htmlMailing List, Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2014-April/131842.htmlMailing List, Third Party Advisory
http://seclists.org/oss-sec/2014/q2/15Mailing List, Third Party Advisory
http://secunia.com/advisories/57647Third Party Advisory
http://secunia.com/advisories/59203Third Party Advisory
http://svn.cacti.net/viewvc?view=rev&revision=7439Patch, Vendor Advisory
http://www.debian.org/security/2014/dsa-2970Third Party Advisory
http://www.securityfocus.com/bid/66630Third Party Advisory, VDB Entry
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=742768Third Party Advisory
https://security.gentoo.org/glsa/201509-03Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2014-April/131821.htmlMailing List, Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2014-April/131842.htmlMailing List, Third Party Advisory
http://seclists.org/oss-sec/2014/q2/15Mailing List, Third Party Advisory
http://secunia.com/advisories/57647Third Party Advisory
http://secunia.com/advisories/59203Third Party Advisory
http://svn.cacti.net/viewvc?view=rev&revision=7439Patch, Vendor Advisory
http://www.debian.org/security/2014/dsa-2970Third Party Advisory
http://www.securityfocus.com/bid/66630Third Party Advisory, VDB Entry
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=742768Third Party Advisory
https://security.gentoo.org/glsa/201509-03Third Party Advisory

Timeline

Published: Apr 23, 2014
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-27106.1Multiple cross-site scripting (XSS) vulnerabilities in Oliver (formerly Webshare) 1.3.1 and earlier allow remote attackers to inject arbitra CVE-2014-27114.3Cross-site scripting (XSS) vulnerability in J-Web in Juniper Junos before 11.4R11, 11.4X27 before 11.4X27.62 (BBE), 12.1 before 12.1R9, 12.1 CVE-2014-27124.3Cross-site scripting (XSS) vulnerability in J-Web in Juniper Junos before 10.0S25, 10.4 before 10.4R10, 11.4 before 11.4R11, 12.1 before 12.CVE-2014-27135.0Juniper Junos before 11.4R11, 12.1 before 12.1R9, 12.2 before 12.2R7, 12.3R4 before 12.3R4-S3, 13.1 before 13.1R4, 13.2 before 13.2R2, and 1 CVE-2014-27147.1The Enhanced Web Filtering (EWF) in Juniper Junos before 10.4R15, 11.4 before 11.4R9, 12.1 before 12.1R7, 12.1X44 before 12.1X44-D20, 12.1X4 CVE-2014-27154.3Multiple cross-site scripting (XSS) vulnerabilities in vwrooms\templates\logout.tpl.php in the VideoWhisper Webcam plugins for Drupal 7.x al CVE-2014-27164.3Ekahau B4 staff badge tag 5.7 with firmware 1.4.52, Real-Time Location System (RTLS) Controller 6.0.5-FINAL, and Activator 3 reuses the RC4 CVE-2014-27177.6Honeywell FALCON XLWeb Linux controller devices 2.04.01 and earlier and FALCON XLWeb XLWebExe controller devices 2.02.11 and earlier allow r CVE-2014-27187.1ASUS RT-AC68U, RT-AC66R, RT-AC66U, RT-AC56R, RT-AC56U, RT-N66R, RT-N66U, RT-N56R, RT-N56U, and possibly other RT-series routers before firmw CVE-2014-27196.3Advanced_System_Content.asp in the ASUS RT series routers with firmware before 3.0.0.4.374.5517, when an administrator session is active, al CVE-2014-27206.8IZArc 4.1.8 displays a file's name on the basis of a ZIP archive's Central Directory entry, but launches this file on the basis of a ZIP arc CVE-2014-27218.8In FortiBalancer 400, 1000, 2000 and 3000, a platform-specific remote access vulnerability has been discovered that may allow a remote user