CVE-2022-48538: Medium severity Cacti Cacti vulnerability
In Cacti 1.2.19, there is an authentication bypass in the web login functionality because of improper validation in the PHP code: cactildapauth() allows a zero as the password.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/cactito a version that resolves this vulnerability.Fixed in 1.2.24+ds1-1+deb12u5Fixed in 1.2.30+ds1-1Fixed in 1.2.31+ds1-4 - Upgrade
Upgrade
debian/cactito a version that resolves this vulnerability.Fixed in 1.2.23+ds1-1
Event History
Frequently Asked Questions
What is the vulnerability ID for this Cacti vulnerability?
The vulnerability ID for this Cacti vulnerability is CVE-2022-48538.
What is the severity of CVE-2022-48538?
The severity of CVE-2022-48538 is medium, with a severity value of 5.3.
How does the authentication bypass vulnerability in Cacti 1.2.19 work?
The authentication bypass in Cacti 1.2.19 occurs due to improper validation in the PHP code, specifically in cacti_ldap_auth(), which allows a zero as the password.
Which version of Cacti is affected by CVE-2022-48538?
CVE-2022-48538 affects Cacti version 1.2.19.
How can I fix the authentication bypass vulnerability in Cacti 1.2.19?
To fix the authentication bypass vulnerability in Cacti 1.2.19, you should update to a patched version recommended by the vendor.