CVE-2014-2708: SQL Injection
Cacti bug#0002405 includes fixes for SQL injection and shell escaping (which could lead to arbitrary command execution). Fixes are available from:
http://svn.cacti.net/viewvc?view=rev&revision=7439
CVE-2014-2708 is for the SQL injection issues in graphxport.php.
CVE-2014-2709 is for the shell escaping issues in lib/rrd.php
References:
http://seclists.org/oss-sec/2014/q2/15
Other sources
Multiple SQL injection vulnerabilities in graphxport.php in Cacti 0.8.7g, 0.8.8b, and earlier allow remote attackers to execute arbitrary SQL commands via the (1) graphstart, (2) graphend, (3) graphheight, (4) graphwidth, (5) graphnolegend, (6) printsource, (7) localgraphid, or (8) rraid parameter.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/cactito a version that resolves this vulnerability.Fixed in 1.2.16+ds1-2+deb11u3Fixed in 1.2.16+ds1-2+deb11u5Fixed in 1.2.24+ds1-1+deb12u5Fixed in 1.2.30+ds1-1 - Upgrade
Upgrade
Cactito a version that resolves this vulnerability.Patch CVE-2014-2708 - Upgrade
Upgrade
Cactito a version that resolves this vulnerability.Patch CVE-2014-2709
Event History
Frequently Asked Questions
What is the severity of CVE-2014-2708?
The severity of CVE-2014-2708 is typically classified as medium due to the potential for SQL injection vulnerabilities.
Which versions of Cacti are affected by CVE-2014-2708?
CVE-2014-2708 affects Cacti versions 0.8.8b and potentially other versions prior to the fixed releases.
How do I fix CVE-2014-2708?
To fix CVE-2014-2708, update Cacti to the latest available version that includes the security patches.
What types of vulnerabilities are addressed in CVE-2014-2708?
CVE-2014-2708 addresses SQL injection and shell escaping vulnerabilities.
Is CVE-2014-2708 still relevant for current systems?
Yes, CVE-2014-2708 is still relevant for systems running affected versions of Cacti that have not been updated.