CVE-2008-0786

EUVD-2008-0793
CRLF injection vulnerability in Cacti 0.8.7 before 0.8.7b and 0.8.6 before 0.8.6k, when running on older PHP interpreters, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.
Code Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4.3 UNKNOWN
NETWORK
MEDIUM
AV:N/AC:M/Au:N/C:N/I:P/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 78%
Affected Products (NVD)
VendorProductVersion
cacticacti
0.6.7
cacticacti
0.8
cacticacti
0.8.1
cacticacti
0.8.2
cacticacti
0.8.2a:a
cacticacti
0.8.3
cacticacti
0.8.3a:a
cacticacti
0.8.4
cacticacti
0.8.5
cacticacti
0.8.5a:a
cacticacti
0.8.6c:c
cacticacti
0.8.6f:f
cacticacti
0.8.6i:i
cacticacti
0.8.6j:j
cacticacti
0.8.7
cacticacti
0.8.7a:a
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
cacti
bookworm
1.2.24+ds1-1+deb12u4
fixed
bookworm (security)
1.2.24+ds1-1+deb12u2
fixed
bullseye
1.2.16+ds1-2+deb11u3
fixed
bullseye (security)
1.2.16+ds1-2+deb11u4
fixed
etch
not-affected
sid
1.2.28+ds1-2
fixed
trixie
1.2.28+ds1-2
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
cacti
dapper
ignored
edgy
ignored
feisty
ignored
gutsy
ignored
hardy
Fixed 0.8.7b-1
released
intrepid
Fixed 0.8.7b-1
released
jaunty
Fixed 0.8.7b-1
released
karmic
Fixed 0.8.7b-1
released
Common Weakness Enumeration
References
http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00001.html
http://secunia.com/advisories/28872
http://secunia.com/advisories/28976
http://secunia.com/advisories/29242
http://secunia.com/advisories/29274
http://security.gentoo.org/glsa/glsa-200803-18.xml
http://securityreason.com/securityalert/3657
http://www.cacti.net/release_notes_0_8_7b.php
http://www.mandriva.com/security/advisories?name=MDVSA-2008:052
http://www.securityfocus.com/archive/1/488013/100/0/threaded
http://www.securityfocus.com/archive/1/488018/100/0/threaded
http://www.securityfocus.com/bid/27749
http://www.securitytracker.com/id?1019414
http://www.vupen.com/english/advisories/2008/0540
https://bugzilla.redhat.com/show_bug.cgi?id=432758
https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00570.html
https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00593.html
http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00001.html
http://secunia.com/advisories/28872
http://secunia.com/advisories/28976
http://secunia.com/advisories/29242
http://secunia.com/advisories/29274
http://security.gentoo.org/glsa/glsa-200803-18.xml
http://securityreason.com/securityalert/3657
http://www.cacti.net/release_notes_0_8_7b.php
http://www.mandriva.com/security/advisories?name=MDVSA-2008:052
http://www.securityfocus.com/archive/1/488013/100/0/threaded
http://www.securityfocus.com/archive/1/488018/100/0/threaded
http://www.securityfocus.com/bid/27749
http://www.securitytracker.com/id?1019414
http://www.vupen.com/english/advisories/2008/0540
https://bugzilla.redhat.com/show_bug.cgi?id=432758
https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00570.html
https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00593.html