CVE-2024-34340

published 2024-05-14

CVE-2024-34340: Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, Cacti calls `compat_password_hash` when users set their…

Priority P3 53 critical 9.1 CVSS 3.1

AV N AC L PR N UI N S U C H I H A N

Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, Cacti calls `compat_password_hash` when users set their password. `compat_password_hash` use `password_hash` if there is it, else use `md5`. When verifying password, it calls `compat_password_verify`. In `compat_password_verify`, `password_verify` is called if there is it, else use `md5`. `password_verify` and `password_hash` are supported on PHP < 5.5.0, following PHP manual. The vulnerability is in `compat_password_verify`. Md5-hashed user input is compared with correct password in database by `$md5 == $hash`. It is a loose comparison, not `===`. It is a type juggling vulnerability. Version 1.2.27 contains a patch for the issue.

Affected

7 ranges

Vendor	Product	Version range	Fixed in
cacti	cacti	< 1.2.27	1.2.27
cacti	cacti	>= 0 < 1.2.16+ds1-2+deb11u4	1.2.16+ds1-2+deb11u4
cacti	cacti	>= 0 < 1.2.24+ds1-1+deb12u3	1.2.24+ds1-1+deb12u3
cacti	cacti	>= 0 < 1.2.27+ds1-1	1.2.27+ds1-1
cacti	cacti	>= 0 < 1.2.27+ds1-1	1.2.27+ds1-1
debian	cacti	< cacti 1.2.24+ds1-1+deb12u3 (bookworm)	cacti 1.2.24+ds1-1+deb12u3 (bookworm)
fedoraproject	fedora	—	—

CVSS provenance

nvd v3.1 9.1 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

osv 9.1 CRITICAL

vendor_debian 9.1 CRITICAL

vendor_ubuntu 9.1 CRITICAL

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-287 CWE-697