CVE-2022-48538 Auth bypass in n/a
Attackers can bypass authentication in Cacti by using a zero password, gaining unauthorized access to the monitoring system.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-48538?
CVE-2022-48538 is a medium-severity authentication bypass vulnerability in Cacti Cacti, published on 22 Aug 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Cacti 1.2.19, there is an authentication bypass in the web login functionality because of improper validation in the PHP code: cacti_ldap_auth() allows a zero as the password.
Weakness: CWE-863
Which versions are affected by CVE-2022-48538?
It affects 1 product.
Products include Cacti Cacti.
How do I fix CVE-2022-48538?
Apply the vendor's patch.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2022-48538 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-48538 exists.
Other vulnerabilities in Cacti Cacti
- CVE-2022-46169 Cacti Command Injection
- CVE-2026-39893 Cacti: Pre-authentication SQL injection via rfilter RLIKE clause in graph_view.php
- CVE-2026-39938 Cacti: Unauthenticated RCE on Graph Image
- CVE-2026-39955 Cacti has Pre-Authentication SQL Injection via unanchored FILTER_VALIDATE_REGEXP in graph_view.php
- CVE-2023-39361 Unauthenticated SQL Injection in graph_view.php in Cacti
Sources
Also known as DEBIAN-CVE-2022-48538, GHSA-fc7r-9282-58jr, UBUNTU-CVE-2022-48538.