PT-2008-2404

CVE-2008-0786

Published

2008-02-14

Updated

2018-10-15

Description by

CVSS 2.0

4.3

Medium

MetricsAV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Cacti versions 0.8.6 through 0.8.6j Cacti versions 0.8.7 through 0.8.7a

Description A CRLF injection issue allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors when running on older PHP interpreters.

Recommendations For Cacti versions 0.8.6 through 0.8.6j, update to version 0.8.6k or later. For Cacti versions 0.8.7 through 0.8.7a, update to version 0.8.7b or later.

Exploitability

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-94: Improper Control of Generation of Code (\'Code Injection\')