{"api_version":"1","generated_at":"2026-07-23T07:15:37+00:00","cve":"CVE-2014-2327","urls":{"html":"https://cve.report/CVE-2014-2327","api":"https://cve.report/api/cve/CVE-2014-2327.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2014-2327","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2014-2327"},"summary":{"title":"CVE-2014-2327","description":"Cross-site request forgery (CSRF) vulnerability in Cacti 0.8.7g, 0.8.8b, and earlier allows remote attackers to hijack the authentication of users for unspecified commands, as demonstrated by requests that (1) modify binary files, (2) modify configurations, or (3) add arbitrary users.","state":"PUBLISHED","assigner":"mitre","published_at":"2014-04-23 15:55:03","updated_at":"2026-05-06 22:30:45"},"problem_types":["CWE-352","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"6.8","severity":"","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:P/A:P","baseScore":6.8,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"}}],"references":[{"url":"http://www.securityfocus.com/archive/1/531588","name":"http://www.securityfocus.com/archive/1/531588","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"],"title":"SecurityFocus","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://lists.opensuse.org/opensuse-updates/2015-03/msg00034.html","name":"http://lists.opensuse.org/opensuse-updates/2015-03/msg00034.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"openSUSE-SU-2015:0479-1: moderate: Security update for cacti","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=742768","name":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=742768","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Issue Tracking","Third Party Advisory"],"title":"#742768 - cacti: CVE-2014-2326 CVE-2014-2327 CVE-2014-2328 - Debian Bug report logs","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://jvn.jp/en/jp/JVN55076671/index.html","name":"http://jvn.jp/en/jp/JVN55076671/index.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"],"title":"JVN#55076671: Cacti vulnerable to cross-site request forgery","mime":"text/xml","httpstatus":"200","archivestatus":"200"},{"url":"http://www.debian.org/security/2014/dsa-2970","name":"http://www.debian.org/security/2014/dsa-2970","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"Debian -- Security Information -- DSA-2970-1 cacti","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/59203","name":"http://secunia.com/advisories/59203","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"Security Advisory SA59203 - Debian update for cacti - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/66392","name":"http://www.securityfocus.com/bid/66392","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"],"title":"Cacti CVE-2014-2327 Cross Site Request Forgery Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://security.gentoo.org/glsa/201509-03","name":"https://security.gentoo.org/glsa/201509-03","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"Gentoo Security","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-002239.html","name":"http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-002239.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"],"title":"","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-2327","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-2327","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2014","cve_id":"2327","vulnerable":"1","versionEndIncluding":"0.8.7g","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"cacti","cpe5":"cacti","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"2327","vulnerable":"1","versionEndIncluding":"0.8.8b","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"cacti","cpe5":"cacti","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"2327","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"debian","cpe5":"debian_linux","cpe6":"7.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"2327","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"debian","cpe5":"debian_linux","cpe6":"8.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"2327","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"opensuse","cpe5":"opensuse","cpe6":"13.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"2327","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"opensuse","cpe5":"opensuse","cpe6":"13.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T10:14:25.026Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"JVN#55076671","tags":["third-party-advisory","x_refsource_JVN","x_transferred"],"url":"http://jvn.jp/en/jp/JVN55076671/index.html"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=742768"},{"name":"JVNDB-2014-002239","tags":["third-party-advisory","x_refsource_JVNDB","x_transferred"],"url":"http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-002239.html"},{"name":"20140324 Deutsche Telekom CERT Advisory [DTC-A-20140324-001] vulnerabilities in cacti","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"],"url":"http://www.securityfocus.com/archive/1/531588"},{"name":"59203","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/59203"},{"name":"openSUSE-SU-2015:0479","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"],"url":"http://lists.opensuse.org/opensuse-updates/2015-03/msg00034.html"},{"name":"66392","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/66392"},{"name":"DSA-2970","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"],"url":"http://www.debian.org/security/2014/dsa-2970"},{"name":"GLSA-201509-03","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred"],"url":"https://security.gentoo.org/glsa/201509-03"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2014-03-24T00:00:00.000Z","descriptions":[{"lang":"en","value":"Cross-site request forgery (CSRF) vulnerability in Cacti 0.8.7g, 0.8.8b, and earlier allows remote attackers to hijack the authentication of users for unspecified commands, as demonstrated by requests that (1) modify binary files, (2) modify configurations, or (3) add arbitrary users."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2016-12-23T18:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"JVN#55076671","tags":["third-party-advisory","x_refsource_JVN"],"url":"http://jvn.jp/en/jp/JVN55076671/index.html"},{"tags":["x_refsource_CONFIRM"],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=742768"},{"name":"JVNDB-2014-002239","tags":["third-party-advisory","x_refsource_JVNDB"],"url":"http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-002239.html"},{"name":"20140324 Deutsche Telekom CERT Advisory [DTC-A-20140324-001] vulnerabilities in cacti","tags":["mailing-list","x_refsource_BUGTRAQ"],"url":"http://www.securityfocus.com/archive/1/531588"},{"name":"59203","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/59203"},{"name":"openSUSE-SU-2015:0479","tags":["vendor-advisory","x_refsource_SUSE"],"url":"http://lists.opensuse.org/opensuse-updates/2015-03/msg00034.html"},{"name":"66392","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/66392"},{"name":"DSA-2970","tags":["vendor-advisory","x_refsource_DEBIAN"],"url":"http://www.debian.org/security/2014/dsa-2970"},{"name":"GLSA-201509-03","tags":["vendor-advisory","x_refsource_GENTOO"],"url":"https://security.gentoo.org/glsa/201509-03"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2014-2327","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Cross-site request forgery (CSRF) vulnerability in Cacti 0.8.7g, 0.8.8b, and earlier allows remote attackers to hijack the authentication of users for unspecified commands, as demonstrated by requests that (1) modify binary files, (2) modify configurations, or (3) add arbitrary users."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"JVN#55076671","refsource":"JVN","url":"http://jvn.jp/en/jp/JVN55076671/index.html"},{"name":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=742768","refsource":"CONFIRM","url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=742768"},{"name":"JVNDB-2014-002239","refsource":"JVNDB","url":"http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-002239.html"},{"name":"20140324 Deutsche Telekom CERT Advisory [DTC-A-20140324-001] vulnerabilities in cacti","refsource":"BUGTRAQ","url":"http://www.securityfocus.com/archive/1/531588"},{"name":"59203","refsource":"SECUNIA","url":"http://secunia.com/advisories/59203"},{"name":"openSUSE-SU-2015:0479","refsource":"SUSE","url":"http://lists.opensuse.org/opensuse-updates/2015-03/msg00034.html"},{"name":"66392","refsource":"BID","url":"http://www.securityfocus.com/bid/66392"},{"name":"DSA-2970","refsource":"DEBIAN","url":"http://www.debian.org/security/2014/dsa-2970"},{"name":"GLSA-201509-03","refsource":"GENTOO","url":"https://security.gentoo.org/glsa/201509-03"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2014-2327","datePublished":"2014-04-23T14:00:00.000Z","dateReserved":"2014-03-12T00:00:00.000Z","dateUpdated":"2024-08-06T10:14:25.026Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2014-04-23 15:55:03","lastModifiedDate":"2026-05-06 22:30:45","problem_types":["CWE-352","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:P/A:P","baseScore":6.8,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:cacti:cacti:*:*:*:*:*:*:*:*","versionStartIncluding":"0.8.7","versionEndIncluding":"0.8.7g","matchCriteriaId":"D08EEA74-DEA9-4547-9028-9FE66BAF1CA3"},{"vulnerable":true,"criteria":"cpe:2.3:a:cacti:cacti:*:*:*:*:*:*:*:*","versionStartIncluding":"0.8.8","versionEndIncluding":"0.8.8b","matchCriteriaId":"AA00CF6C-501D-4212-A6C8-85644E40455C"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*","matchCriteriaId":"16F59A04-14CF-49E2-9973-645477EA09DA"},{"vulnerable":true,"criteria":"cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*","matchCriteriaId":"C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*","matchCriteriaId":"A10BC294-9196-425F-9FB0-B1625465B47F"},{"vulnerable":true,"criteria":"cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*","matchCriteriaId":"03117DF1-3BEC-4B8D-AD63-DBBDB2126081"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2014","CveId":"2327","Ordinal":"1","Title":"CVE-2014-2327","CVE":"CVE-2014-2327","Year":"2014"},"notes":[{"CveYear":"2014","CveId":"2327","Ordinal":"1","NoteData":"Cross-site request forgery (CSRF) vulnerability in Cacti 0.8.7g, 0.8.8b, and earlier allows remote attackers to hijack the authentication of users for unspecified commands, as demonstrated by requests that (1) modify binary files, (2) modify configurations, or (3) add arbitrary users.","Type":"Description","Title":"CVE-2014-2327"},{"CveYear":"2014","CveId":"2327","Ordinal":"2","NoteData":"2014-04-23","Type":"Other","Title":"Published"},{"CveYear":"2014","CveId":"2327","Ordinal":"3","NoteData":"2016-12-23","Type":"Other","Title":"Modified"}]}}}