CVE-2024-34340 Authentication Bypass when using using older password hashes
Attackers can bypass authentication in Cacti by exploiting a PHP type juggling vulnerability in password verification logic.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-34340?
CVE-2024-34340 is a critical authentication bypass vulnerability in Cacti Cacti, published on 13 May 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, Cacti calls `compat_password_hash` when users set their password. `compat_password_hash` use `password_hash` if there is it, else use `md5`. When verifying password, it calls `compat_password_verify`. In `compat_password_verify`, `password_verify` is called if there is it, else use `md5`. `password_verify` and `password_hash` are supported on PHP < 5.5.0, following PHP manual. The vulnerability is in `compat_password_verify`. Md5-hashed user input is compared with correct password in database by `$md5 == $hash`. It is a loose comparison, not `===`. It is a type juggling vulnerability. Version 1.2.27 contains a patch for the issue.
Which versions are affected by CVE-2024-34340?
It affects 2 products.
Products include Cacti Cacti, Fedoraproject Fedora.
How do I fix CVE-2024-34340?
Upgrade to a fixed version.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2024-34340 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-34340 exists.
Other vulnerabilities in Cacti Cacti
- CVE-2022-46169 Cacti Command Injection
- CVE-2026-39893 Cacti: Pre-authentication SQL injection via rfilter RLIKE clause in graph_view.php
- CVE-2026-39938 Cacti: Unauthenticated RCE on Graph Image
- CVE-2026-39955 Cacti has Pre-Authentication SQL Injection via unanchored FILTER_VALIDATE_REGEXP in graph_view.php
- CVE-2023-39361 Unauthenticated SQL Injection in graph_view.php in Cacti
Sources
Also known as CLEANSTART-2024-RX24282, DEBIAN-CVE-2024-34340, GHSA-37x7-mfjv-mm7m, UBUNTU-CVE-2024-34340.