CVE-2014-5261: Code Injection
First published: Fri Aug 22 2014(Updated: )
The graph settings script (graph_settings.php) in Cacti 0.8.8b and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in a font size, related to the rrdtool commandline in lib/rrd.php.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cacti | <=0.8.8b | |
| Cacti | =0.8.6e | |
| Cacti | =0.8.7 | |
| Cacti | =0.8.7a | |
| Cacti | =0.8.7b | |
| Cacti | =0.8.7c | |
| Cacti | =0.8.7d | |
| Cacti | =0.8.7e | |
| Cacti | =0.8.7f | |
| Cacti | =0.8.7g | |
| Cacti | =0.8.7i | |
| Cacti | =0.8.8 | |
| Cacti | =0.8.8a |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://seclists.org/oss-sec/2014/q3/351
- http://seclists.org/oss-sec/2014/q3/386
- http://svn.cacti.net/viewvc?view=rev&revision=7454
- http://www.debian.org/security/2014/dsa-3007
- http://www.securityfocus.com/bid/69213
- https://bugzilla.redhat.com/show_bug.cgi?id=1127165
- https://exchange.xforce.ibmcloud.com/vulnerabilities/95292
- https://security.gentoo.org/glsa/201607-05
Frequently Asked Questions
What is the severity of CVE-2014-5261?
CVE-2014-5261 has a high severity rating due to its potential for remote command execution.
How do I fix CVE-2014-5261?
To fix CVE-2014-5261, upgrade Cacti to version 0.8.8c or later.
What types of attacks are possible with CVE-2014-5261?
CVE-2014-5261 allows attackers to execute arbitrary commands on the server via input manipulation.
Which versions of Cacti are affected by CVE-2014-5261?
CVE-2014-5261 affects Cacti versions up to and including 0.8.8b and specific older versions.
Can the exploitation of CVE-2014-5261 lead to data breaches?
Yes, the exploitation of CVE-2014-5261 could lead to unauthorized access and potential data breaches.
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/remedy
- agent/author
- agent/last-modified-date
- agent/severity
- agent/weakness
- agent/first-publish-date
- agent/event
- agent/description
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/cacti
- canonical/cacti
- version/cacti/0.8.8b
- version/cacti/0.8.6e
- version/cacti/0.8.7
- version/cacti/0.8.7a
- version/cacti/0.8.7b
- version/cacti/0.8.7c
- version/cacti/0.8.7d
- version/cacti/0.8.7e
- version/cacti/0.8.7f
- version/cacti/0.8.7g
- version/cacti/0.8.7i
- version/cacti/0.8.8
- version/cacti/0.8.8a