CVE-2014-5261

Name of the Vulnerable Software and Affected Versions Cacti versions 0.8.8b and earlier

Description The issue allows remote attackers to execute arbitrary commands via shell metacharacters in a font size, related to the rrdtool commandline in lib/rrd.php. This is due to a problem in the graph settings script (graph settings.php).

Recommendations For versions 0.8.8b and earlier, update to a version later than 0.8.8b to resolve the issue. As a temporary workaround, consider restricting access to the graph settings.php script and the rrdtool commandline in lib/rrd.php to minimize the risk of exploitation.