Unscored severity · published Apr 23, 2014
CVE-2014-2327
Cross-site request forgery (CSRF) vulnerability in Cacti 0.8.7g, 0.8.8b, and earlier allows remote attackers to hijack the authentication of users for unspecified commands, as…
–
CVSS
2.3%
EPSS
No
On KEV
Description
Cross-site request forgery (CSRF) vulnerability in Cacti 0.8.7g, 0.8.8b, and earlier allows remote attackers to hijack the authentication of users for unspecified commands, as demonstrated by requests that (1) modify binary files, (2) modify configurations, or (3) add arbitrary users.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.3% · higher than 83% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CA
Cacti · Cacti
0.8.7 through 0.8.7g; 0.8.8 through 0.8.8b · source: NVD
DL
Debian Linux · Debian
7.0; 8.0 · source: NVD
OP
Opensuse · Opensuse
13.1; 13.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-2327
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-2327
Third Party Advisory
http://jvn.jp/en/jp/JVN55076671/index.html
Third Party Advisory
http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-002239.html
Third Party Advisory
http://lists.opensuse.org/opensuse-updates/2015-03/msg00034.html
Third Party Advisory
http://secunia.com/advisories/59203
Third Party Advisory
http://www.debian.org/security/2014/dsa-2970
Third Party Advisory
http://www.securityfocus.com/archive/1/531588
More from Cacti
9.8
CVE-2022-46169
Unauthenticated Command Injection
10.0
CVE-2024-29895
Cacti command injection in cmd_realtime.php
9.8
CVE-2026-40079
Cacti: Command Injection via escape_command() no-op in RRDtool execution
9.8
CVE-2026-39948
Cacti has SQL Injection via rfilter parameter in RLIKE clauses
9.8
CVE-2026-39955
Cacti has Pre-Authentication SQL Injection via unanchored FILTER_VALIDATE_REGEXP in graph_view.php