CVE-2014-4002: XSS
Multiple cross-site scripting (XSS) vulnerabilities in Cacti 0.8.8b allow remote attackers to inject arbitrary web script or HTML via the (1) drpaction parameter to cdef.php, (2) datainput.php, (3) dataqueries.php, (4) datasources.php, (5) datatemplates.php, (6) graphtemplates.php, (7) graphs.php, (8) host.php, or (9) hosttemplates.php or the (10) graphtemplateinputid or (11) graphtemplateid parameter to graphtemplatesinputs.php.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2014-4002?
CVE-2014-4002 is classified as a moderate severity vulnerability due to its potential for exploitation via cross-site scripting.
What are the affected versions in CVE-2014-4002?
CVE-2014-4002 affects Cacti version 0.8.8b and may also impact certain versions of Cacti within Debian and openSUSE distributions.
How do I fix CVE-2014-4002?
To mitigate CVE-2014-4002, upgrade to a secure version of Cacti that is patched against these XSS vulnerabilities.
What types of attacks can CVE-2014-4002 enable?
CVE-2014-4002 can enable attackers to carry out cross-site scripting (XSS) attacks that may lead to session hijacking or redirecting users to malicious sites.
Who is vulnerable to CVE-2014-4002?
Users running vulnerable versions of Cacti, particularly version 0.8.8b, are susceptible to CVE-2014-4002.