CVE-2016-2313

8.8 highEPSS 2.7%

High (8.8). EPSS 2.7% chance of exploitation in the next 30 days.

auth_login.php in Cacti before 0.8.8g allows remote authenticated users who use web authentication to bypass intended access restrictions by logging in as a user not in the cacti database.

Severity

CVSS 3.0

8.8 high

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 2.7% chance of exploitation in the next 30 days; higher than 85% of CVEs (scores of 2026-10-31)
CWE: CWE-264
Published: 2016-04-13
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

cacti:cacti
opensuse:leap
opensuse:opensuse

References

http://bugs.cacti.net/view.php?id=2656
http://lists.opensuse.org/opensuse-updates/2016-02/msg00077.html
http://lists.opensuse.org/opensuse-updates/2016-02/msg00078.html
http://lists.opensuse.org/opensuse-updates/2016-02/msg00080.html
http://www.cacti.net/release_notes_0_8_8g.php

Check your stack JSON