CVE-2014-5026: XSS

Published Oct 20, 2014

Updated

Multiple cross-site scripting (XSS) vulnerabilities in Cacti 0.8.8b allow remote authenticated users with console access to inject arbitrary web script or HTML via a (1) Graph Tree Title in a delete or (2) edit action; (3) CDEF Name, (4) Data Input Method Name, or (5) Host Templates Name in a delete action; (6) Data Source Title; (7) Graph Title; or (8) Graph Template Name in a delete or (9) duplicate action.

Affected Software

4 affected components

Debian Debian Linux=7.0

Cacti Cacti=0.8.8b

openSUSE openSUSE=13.1

openSUSE openSUSE=13.2

Event History

Oct 20, 2014

CVE Published

via MITRE·05:00 PM

Data Sourced

via MITRE·05:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2014-5026?

CVE-2014-5026 has a medium severity rating due to the potential for remote code execution through cross-site scripting.

How do I fix CVE-2014-5026?

To fix CVE-2014-5026, upgrade to a newer version of Cacti that addresses these vulnerabilities.

Who is affected by CVE-2014-5026?

CVE-2014-5026 affects Cacti version 0.8.8b and specific versions of Debian and openSUSE.

What are the main vulnerabilities in CVE-2014-5026?

CVE-2014-5026 includes multiple cross-site scripting vulnerabilities that allow authenticated users to inject arbitrary scripts.

Can CVE-2014-5026 be exploited by unauthenticated users?

No, CVE-2014-5026 requires authenticated users with console access to exploit the vulnerabilities.