CVE-2022-48538 — Incorrect Authorization in Cacti

CWE-863 — Incorrect Authorization4 documents4 sources
Severity
5.3MEDIUMNVD
EPSS
0.1%
top 79.10%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
CactiDebian Cacti
Timeline
PublishedAug 22

Description

In Cacti 1.2.19, there is an authentication bypass in the web login functionality because of improper validation in the PHP code: cacti_ldap_auth() allows a zero as the password.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NExploitability: 3.9 | Impact: 1.4

Affected Packages3 packages

▶debiandebian/cacti< cacti 1.2.23+ds1-1 (bookworm)
▶Debiancacti/cacti< 1.2.23+ds1-1+2
▶NVDcacti/cacti1.2.19

🔴Vulnerability Details

2
GHSA
GHSA-fc7r-9282-58jr: In Cacti 1↗2023-08-22
▶
OSV
CVE-2022-48538: In Cacti 1↗2023-08-22
▶

📋Vendor Advisories

1
Debian
CVE-2022-48538: cacti - In Cacti 1.2.19, there is an authentication bypass in the web login functionalit...↗2022
▶