CVE-2014-4000
First published: Wed Nov 15 2017(Updated: )
Cacti before 1.0.0 allows remote authenticated users to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted serialized object, related to calling unserialize(stripslashes()).
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| debian/cacti | 1.2.2+ds1-2+deb10u4 1.2.2+ds1-2+deb10u5 1.2.16+ds1-2+deb11u1 1.2.24+ds1-1 1.2.25+ds1-2 | |
| Cacti Cacti | <1.0.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.cacti.net/release_notes_1_0_0.php
- http://bugs.cacti.net/view.php?id=2452
- http://svn.cacti.net/viewvc?view=rev&revision=7731
- https://security-tracker.debian.org/tracker/CVE-2014-4000
- https://forums.cacti.net/viewtopic.php?f=4&t=56794
- https://security.gentoo.org/glsa/201711-10
- https://www.cacti.net/release_notes_1_0_0.php
- collector/security-tracker-debian
- collector/nvd-index
- package-manager/debian
- vendor/cacti
- product/cacti
- canonical/cacti cacti