Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Thu, 24 Jul 2014 22:06:52 +0200
From: Adan Alvarez <>
Subject: Re: Duplicated CVE - Cacti XSS


A user with  "User Administration" enabled under "Realm Permissions" does
not need to have all of the Realm Permissions but this user will be able to
modify their own permissions. For this reason, I think the CVE-2014-5043 is
not needed.


2014-07-24 21:26 GMT+02:00 <>:

> Hash: SHA1
> > I requested a CVE to mitre
> >
> > CVE-2014-5043.
> >
> > another XSS vulnerability that is not solved by the current patch.
> >
> > Here you have the details to reproduce it:
> >
> > Create a new user or edit an existing one with the following Full
> > Name: [XSS] Then go to System Utilities - View User Log, and if the
> > user has logged in you will see a popup with the text "XSS".
> >
> > Maybe the CVE-2014-5043 can by used to identify this last discovery.
> Yes, this is what we will do. CVE-2014-5043 was not previously bound
> to any conflicting public vulnerability information, so we will
> establish the public scope of CVE-2014-5043 as exclusively this new
> "System Utilities - View User Log" XSS issue. Our understanding is
> that this crosses privilege boundaries because the attacker must have
> "User Administration" enabled under "Realm Permissions" but the
> attacker does not need to have all of the Realm Permissions. If this
> is incorrect and "User Administration" is always equivalent to the
> "admin" user at all Cacti sites, then this CVE wouldn't be needed.
> In any case,
> still defines the meaning of CVE-2014-5025 and CVE-2014-5026.
> - --
> CVE assignment team, MITRE CVE Numbering Authority
> M/S M300
> 202 Burlington Road, Bedford, MA 01730 USA
> [ PGP key available through ]
> Version: GnuPG v1.4.14 (SunOS)
> iQEcBAEBAgAGBQJT0V1ZAAoJEKllVAevmvms1I8H/ig+KhutHxd5FBmV0V3Id9bj
> 5uxkBIIKw6kA7LM5KU8bnAc6PeE5Xg2N8GJCL5wlysGluCAT+Dbco2X8Nvsi4RUG
> AM3Z/WcxTA+duHpRea2Cd9W3PRGnx42vQDFAuIB44MLKjHtlENasic6BauBw+gy6
> F6CrX463/o6A5fXu1U7PMEKRKwIRozdLxuTrEJhhUJe012sRchQRvDme2nKtHOz5
> woCD8BPh8t5iO5TPzAI0+Fc8EQMduN2RpvsQhZanYZDjVdnCayi2p/at02RDk/Xq
> OoOVDBue0T4smnH50qNYYSknn0e0C9zSlXUefL54JNO+7qoqbDzHt1vNFmw3io0=
> =mGH4

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.