CVE-2024-34340

Name
CVE-2024-34340
Description
Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, Cacti calls `compat_password_hash` when users set their password. `compat_password_hash` use `password_hash` if there is it, else use `md5`. When verifying password, it calls `compat_password_verify`. In `compat_password_verify`, `password_verify` is called if there is it, else use `md5`. `password_verify` and `password_hash` are supported on PHP < 5.5.0, following PHP manual. The vulnerability is in `compat_password_verify`. Md5-hashed user input is compared with correct password in database by `$md5 == $hash`. It is a loose comparison, not `===`. It is a type juggling vulnerability. Version 1.2.27 contains a patch for the issue.
NVD Severity
unknown
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
security-advisories@github.com https://github.com/Cacti/cacti/security/advisories/GHSA-37x7-mfjv-mm7m
Product https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RBEOAFKRARQHTDIYSL723XAFJ2Q6624X/
af854a3a-2127-422b-91ae-364da2661108 https://lists.debian.org/debian-lts-announce/2024/09/msg00027.html

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:cacti:cacti:*:*:*:*:*:*:*:* cacti >= None < 1.2.27

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
cacti edge-community 1.2.27-r0 Jeff Bilyk <jbilyk@gmail.com> fixed
cacti edge-community 1.2.26-r0 Jeff Bilyk <jbilyk@gmail.com> possibly vulnerable
cacti edge-community 1.2.25-r0 Jeff Bilyk <jbilyk@gmail.com> possibly vulnerable
cacti edge-community 1.2.20-r0 Jeff Bilyk <jbilyk@gmail.com> possibly vulnerable
cacti edge-community 1.2.17-r0 Jeff Bilyk <jbilyk@gmail.com> possibly vulnerable
cacti edge-community 1.2.13-r0 None possibly vulnerable
cacti edge-community 1.2.8-r0 None possibly vulnerable
cacti 3.22-community 1.2.27-r0 None fixed
cacti 3.22-community 1.2.26-r0 None possibly vulnerable
cacti 3.22-community 1.2.25-r0 None possibly vulnerable
cacti 3.22-community 1.2.20-r0 None possibly vulnerable
cacti 3.22-community 1.2.17-r0 None possibly vulnerable
cacti 3.22-community 1.2.13-r0 None possibly vulnerable
cacti 3.22-community 1.2.8-r0 None possibly vulnerable
cacti 3.21-community 1.2.27-r0 None fixed
cacti 3.20-community 1.2.27-r0 Jeff Bilyk <jbilyk@gmail.com> fixed
cacti 3.19-community 1.2.27-r0 Jeff Bilyk <jbilyk@gmail.com> fixed