Detections
Analytics
Alpine: multiple cacti packages: security update to 0.8.8-r0 (deprecated)
high Tenable Self-Hosted Container Security Plugin ID 401083
Description
There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:- lib/rrd.php in Cacti 0.8.7g, 0.8.8b, and earlier allows remote attackers to execute arbitrary commands via
shell metacharacters in unspecified parameters. (CVE-2014-2709)
- Cross-site scripting (XSS) vulnerability in cdef.php in Cacti 0.8.7g, 0.8.8b, and earlier allows remote
attackers to inject arbitrary web script or HTML via unspecified vectors. (CVE-2014-2326)
- Cross-site request forgery (CSRF) vulnerability in Cacti 0.8.7g, 0.8.8b, and earlier allows remote
attackers to hijack the authentication of users for unspecified commands, as demonstrated by requests that
(1) modify binary files, (2) modify configurations, or (3) add arbitrary users. (CVE-2014-2327)
- lib/graph_export.php in Cacti 0.8.7g, 0.8.8b, and earlier allows remote authenticated users to execute
arbitrary commands via shell metacharacters in unspecified vectors. (CVE-2014-2328)
- Multiple SQL injection vulnerabilities in graph_xport.php in Cacti 0.8.7g, 0.8.8b, and earlier allow
remote attackers to execute arbitrary SQL commands via the (1) graph_start, (2) graph_end, (3)
graph_height, (4) graph_width, (5) graph_nolegend, (6) print_source, (7) local_graph_id, or (8) rra_id
parameter. (CVE-2014-2708)
See Also
https://git.alpinelinux.org/aports/commit/?id=4578d67602e28e896f1398c887ad454635ae912b
https://git.alpinelinux.org/aports/commit/?id=fa2998fd037f72a85b53903b13a23d50a22aa3c9
Plugin Details
Severity: High
ID: 401083
Version: Revision 1.25
Type: Local
Published: 8/16/2023
Updated: 7/2/2026
Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Medium
Score: 5
Percentile: 95.11
CVSS v2
Risk Factor: High
Base Score: 7.5
Temporal Score: 5.9
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS Score Source: CVE-2014-2709
CVSS v3
Risk Factor: High
Base Score: 8.8
Temporal Score: 7.9
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
Vulnerability Information
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 7/7/2014
Vulnerability Publication Date: 3/25/2014
Reference Information
CVE: CVE-2014-2326, CVE-2014-2327, CVE-2014-2328, CVE-2014-2708, CVE-2014-2709, CVE-2014-4002