Cacti vulnerability in `compat_password_verify` function

CVE-2024-34340

What is CVE-2024-34340?

Cacti, an operational monitoring and fault management framework, has a vulnerability stemming from its password verification method prior to version 1.2.27. The issue arises in the compat_password_verify component, where comparisons of md5-hashed user input and the stored password in the database utilize a loose comparison method ($md5 == $hash). This can lead to type juggling vulnerabilities, potentially allowing unauthorized parties to gain access to user accounts. A patch addressing this vulnerability was released in version 1.2.27.

References