Cacti CVE-2014-2326 Unspecified HTML Injection Vulnerability
BID:66390
Info
Cacti CVE-2014-2326 Unspecified HTML Injection Vulnerability
| Bugtraq ID: | 66390 |
| Class: | Input Validation Error |
| CVE: |
CVE-2014-2326 |
| Remote: | Yes |
| Local: | No |
| Published: | Mar 25 2014 12:00AM |
| Updated: | Oct 26 2015 04:46PM |
| Credit: | Deutsche Telekom CERT |
| Vulnerable: |
Gentoo Linux Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64 Cacti Cacti 0.8.7g |
| Not Vulnerable: | |
Discussion
Cacti CVE-2014-2326 Unspecified HTML Injection Vulnerability
Cacti is prone to an unspecified HTML-injection vulnerability because it fails to properly sanitize user-supplied input.
Attacker-supplied HTML and script code would run in the context of the affected website, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user.
Cacti 0.8.7g is vulnerable; other versions may also be affected.
Cacti is prone to an unspecified HTML-injection vulnerability because it fails to properly sanitize user-supplied input.
Attacker-supplied HTML and script code would run in the context of the affected website, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user.
Cacti 0.8.7g is vulnerable; other versions may also be affected.
Exploit / POC
Cacti CVE-2014-2326 Unspecified HTML Injection Vulnerability
An attacker can exploit this issue through a browser.
An attacker can exploit this issue through a browser.
Solution / Fix
Cacti CVE-2014-2326 Unspecified HTML Injection Vulnerability
Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].