GitHub Advisoryadvisory · Packagist

GHSA-277v-gwfr-hmpj Missing Authentication for Critical Function in LibreNMS

MEDIUM Published 2019-10-11 Modified 2021-05-11 Official page ↗
Aliases
CVE-2019-10668
Ecosystem
Packagist
Packages
librenms/librenms
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-306
Reviewed
2019-09-25

Affected packages

• Packagist librenms/librenms: < 1.50.1 → fixed in 1.50.1

Description

An issue was discovered in LibreNMS through 1.47. A number of scripts import the Authentication libraries, but do not enforce an actual authentication check. Several of these scripts disclose information or expose functions that are of a sensitive nature and are not expected to be publicly accessible.

Related

Alias · CVE (1)

  • CVE-2019-10668 An issue was discovered in LibreNMS through 1.47. vulnerability

Weakness · CWE (1)

  • CWE-306 Missing Authentication for Critical Functionality weakness

References