[Forgot Password]
Login  Register Subscribe

30389

 
 

423868

 
 

244625

 
 

909

 
 

193379

 
 

277

Paid content will be excluded from the download.


Download | Alert*
CVE
view JSON

CVE-2014-2708Date: (C)2014-04-11   (M)2023-12-22


Multiple SQL injection vulnerabilities in graph_xport.php in Cacti 0.8.7g, 0.8.8b, and earlier allow remote attackers to execute arbitrary SQL commands via the (1) graph_start, (2) graph_end, (3) graph_height, (4) graph_width, (5) graph_nolegend, (6) print_source, (7) local_graph_id, or (8) rra_id parameter.

CVSS Score and Metrics +CVSS Score and Metrics -

CVSS V2 Severity:
CVSS Score : 7.5
Exploit Score: 10.0
Impact Score: 6.4
 
CVSS V2 Metrics:
Access Vector: NETWORK
Access Complexity: LOW
Authentication: NONE
Confidentiality: PARTIAL
Integrity: PARTIAL
Availability: PARTIAL
  
Reference:
SECUNIA-57647
SECUNIA-59203
BID-66555
DSA-2970
FEDORA-2014-4892
FEDORA-2014-4928
GLSA-201509-03
http://seclists.org/oss-sec/2014/q2/2
http://seclists.org/oss-sec/2014/q2/15
cacti-cve20142708-sql-injection(92278)
http://bugs.cacti.net/view.php?id=2405
http://svn.cacti.net/viewvc?view=rev&revision=7439
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=742768
https://bugzilla.redhat.com/show_bug.cgi?id=1084258

CPE    1
cpe:/a:cacti:cacti:0.8.8b
CWE    1
CWE-89
OVAL    6
oval:org.secpod.oval:def:106895
oval:org.secpod.oval:def:107161
oval:org.secpod.oval:def:107168
oval:org.secpod.oval:def:106867
...

© SecPod Technologies