Injection Vulnerability in LibreNMS Affects Graphing Options
CVE-2019-10665

9.8CRITICAL

Key Information:

Vendor

Librenms

Status
Librenms
Vendor
CVE Published:
9 September 2019

What is CVE-2019-10665?

A vulnerability in LibreNMS versions up to 1.47 allows attackers to inject RRDtool syntax via unvalidated user input in the graphing scripts. Due to insufficient input validation in critical files (html/includes/graphs/common.inc.php and html/includes/graphs/graphs.inc.php), an attacker can utilize newline characters to perform various attacks. This includes potential directory disclosure, access to sensitive file content, denial of service, or arbitrary file writing, posing a significant risk to systems utilizing LibreNMS.

References

https://www.darkmatter.ae/xen1thlabs/librenms-rrdtool-inj...
x_refsource_MISC

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.