Injection Vulnerability in LibreNMS by LibreNMS, Inc.
CVE-2019-12463

8.8HIGH

Key Information:

Vendor

Librenms

Status
Librenms
Vendor
CVE Published:
9 September 2019

What is CVE-2019-12463?

An injection vulnerability exists in LibreNMS version 1.50.1 that stems from insufficient validation of user-supplied input in specific graphing scripts. Attackers can exploit this flaw by injecting RRDtool syntax through parameters, potentially leading to various impacts such as disclosing sensitive directory structures and filenames, revealing file contents, or executing denial of service attacks. This vulnerability specifically requires authentication to access the affected scripts, demonstrating the necessity for secure coding practices in handling user data.

References

https://www.darkmatter.ae/xen1thlabs/librenms-rrdtool-inj...
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.