Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2024-34340: Cacti older versions let attackers log in without correct password

CVE-2024-34340 · published 2 years ago

Summary

Versions of Cacti before 1.2.27 compare old MD5 password hashes in a way that can be tricked, allowing someone to gain access without knowing the real password. This could let unauthorized users view or change your monitoring data. Upgrade Cacti to version 1.2.27 or later, or apply the official patch, to close the gap.

What to do

Update debian cacti to version 1.2.24+ds1-1+deb12u3.
Update debian cacti to version 1.2.27+ds1-1.
Update cacti cacti to version 1.2.27 or later.

Affected software

Ecosystem	Vendor	Product	Affected versions
Debian:12	debian	cacti	< 1.2.24+ds1-1+deb12u3 Fix: upgrade to 1.2.24+ds1-1+deb12u3
Debian:13	debian	cacti	< 1.2.27+ds1-1 Fix: upgrade to 1.2.27+ds1-1
Debian:14	debian	cacti	< 1.2.27+ds1-1 Fix: upgrade to 1.2.27+ds1-1
–	cacti	cacti	< 1.2.27 `cpe:2.3:a:cacti:cacti::::::::`
–	fedoraproject	fedora	39 `cpe:2.3:o:fedoraproject:fedora:39:::::::*`

Original advisory text

Authentication Bypass when using using older password hashes

Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, Cacti calls `compat_password_hash` when users set their password. `compat_password_hash` use `password_hash` if there is it, else use `md5`. When verifying password, it calls `compat_password_verify`. In `compat_password_verify`, `password_verify` is called if there is it, else use `md5`. `password_verify` and `password_hash` are supported on PHP < 5.5.0, following PHP manual. The vulnerability is in `compat_password_verify`. Md5-hashed user input is compared with correct password in database by `$md5 == $hash`. It is a loose comparison, not `===`. It is a type juggling vulnerability. Version 1.2.27 contains a patch for the issue.

References

https://security-tracker.debian.org/tracker/CVE-2024-34340 Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/34xxx/CVE-2024-34340... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-34340 Vendor Advisory
https://lists.debian.org/debian-lts-announce/2024/09/msg00027.html URL
https://lists.fedoraproject.org/archives/list/[email protected]... URL
https://github.com/Cacti/cacti/security/advisories/GHSA-37x7-mfjv-mm7m Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

9.1 Critical

Exploitation

1% chance of attack within 30 days

Type

CWE-287Improper Authentication

CWE-697Incorrect Comparison

Timeline

Published14 May 2024

Updated4 Nov 2026

First seen1 Sep 2026

Sources

DEBIAN-CVE-2024-34340 · OSV

CVE-2024-34340 · NVD

CVE-2024-34340 · OSV

GHSA-37x7-mfjv-mm7m · GHSA

Track software like this

Free during beta