CVE-2014-4000: Code Injection
First published: Wed Nov 15 2017(Updated: )
Cacti before 1.0.0 allows remote authenticated users to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted serialized object, related to calling unserialize(stripslashes()).
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| debian/cacti | 1.2.2+ds1-2+deb10u4 1.2.2+ds1-2+deb10u5 1.2.16+ds1-2+deb11u1 1.2.24+ds1-1 1.2.25+ds1-2 | |
| Cacti | <1.0.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.cacti.net/release_notes_1_0_0.php
- http://bugs.cacti.net/view.php?id=2452
- http://svn.cacti.net/viewvc?view=rev&revision=7731
- https://security-tracker.debian.org/tracker/CVE-2014-4000
- https://forums.cacti.net/viewtopic.php?f=4&t=56794
- https://security.gentoo.org/glsa/201711-10
- https://www.cacti.net/release_notes_1_0_0.php
Frequently Asked Questions
What is the severity of CVE-2014-4000?
CVE-2014-4000 is considered a significant vulnerability due to its potential for PHP object injection and remote code execution.
How do I fix CVE-2014-4000?
To fix CVE-2014-4000, update Cacti to version 1.0.0 or later, ensuring that no affected versions are in use.
Who is affected by CVE-2014-4000?
CVE-2014-4000 affects all Cacti installations prior to version 1.0.0 that allow remote authenticated users to input crafted serialized objects.
What type of attacks does CVE-2014-4000 enable?
CVE-2014-4000 enables remote authenticated users to conduct PHP object injection attacks, leading to execution of arbitrary PHP code.
What versions of Cacti are vulnerable to CVE-2014-4000?
Versions of Cacti prior to 1.0.0 are vulnerable to CVE-2014-4000.
- collector/security-tracker-debian
- agent/severity
- agent/author
- agent/weakness
- agent/type
- agent/description
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- agent/tags
- agent/references
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/event
- package-manager/debian
- vendor/cacti
- canonical/cacti