medium4.3

CVE-2014-2326

Cross-site scripting (XSS) vulnerability in cdef.php in Cacti 0.8.7g, 0.8.8b, and earlier allows remote attackers to inject arbitrary web script or HTML via un…

Impact

Cross-site scripting (XSS) vulnerability in cdef.php in Cacti 0.8.7g, 0.8.8b, and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Affected products

Vendor	Product	Affected versions
Fedoraproject	Fedora	Versions 19, 20
Opensuse	Opensuse	Versions 13.1, 13.2
Cacti	Cacti	Version 0.8.7g
Debian	Debian Linux	Version 7.0

Weakness classification

CWE-79

References

NVD record
CVE.org record
http://bugs.cacti.net/view.php?id=2431
http://lists.fedoraproject.org/pipermail/package-announce/2014-April/131821.html
http://lists.fedoraproject.org/pipermail/package-announce/2014-April/131842.html
http://lists.opensuse.org/opensuse-updates/2015-03/msg00034.html
http://packetstormsecurity.com/files/125849/Deutsche-Telekom-CERT-Advisory-DTC-A-20140324-001.html
http://secunia.com/advisories/57647
http://secunia.com/advisories/59203
http://svn.cacti.net/viewvc?view=rev&revision=7443
http://www.debian.org/security/2014/dsa-2970
http://www.securityfocus.com/archive/1/531588
http://www.securityfocus.com/bid/66390
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=742768
https://security.gentoo.org/glsa/201509-03
http://bugs.cacti.net/view.php?id=2431
http://lists.fedoraproject.org/pipermail/package-announce/2014-April/131821.html
http://lists.fedoraproject.org/pipermail/package-announce/2014-April/131842.html
http://lists.opensuse.org/opensuse-updates/2015-03/msg00034.html
http://packetstormsecurity.com/files/125849/Deutsche-Telekom-CERT-Advisory-DTC-A-20140324-001.html
http://secunia.com/advisories/57647
http://secunia.com/advisories/59203
http://svn.cacti.net/viewvc?view=rev&revision=7443
http://www.debian.org/security/2014/dsa-2970
http://www.securityfocus.com/archive/1/531588
http://www.securityfocus.com/bid/66390
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=742768