We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Crisp.chat (Helpdesk and Chat)

Ok

THREATINT
PUBLISHED

CVE-2024-34340

Authentication Bypass when using using older password hashes



Description

Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, Cacti calls `compat_password_hash` when users set their password. `compat_password_hash` use `password_hash` if there is it, else use `md5`. When verifying password, it calls `compat_password_verify`. In `compat_password_verify`, `password_verify` is called if there is it, else use `md5`. `password_verify` and `password_hash` are supported on PHP < 5.5.0, following PHP manual. The vulnerability is in `compat_password_verify`. Md5-hashed user input is compared with correct password in database by `$md5 == $hash`. It is a loose comparison, not `===`. It is a type juggling vulnerability. Version 1.2.27 contains a patch for the issue.

Reserved 2024-05-02 | Published 2024-05-13 | Updated 2025-02-13 | Assigner GitHub_M


CRITICAL: 9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Problem types

CWE-287: Improper Authentication

CWE-697: Incorrect Comparison

Product status

< 1.2.27
affected

References

github.com/.../cacti/security/advisories/GHSA-37x7-mfjv-mm7m

lists.fedoraproject.org/...RBEOAFKRARQHTDIYSL723XAFJ2Q6624X/

cve.org (CVE-2024-34340)

nvd.nist.gov (CVE-2024-34340)

Download JSON

Share this page
https://cve.threatint.eu/CVE/CVE-2024-34340

Support options

Helpdesk Chat, Email, Knowledgebase