GitHub Advisoryadvisory · Packagist

GHSA-g9xh-3w5g-229r SQL Injection in LibreNMS

HIGH Published 2019-10-11 Modified 2021-08-18 Official page ↗
Aliases
CVE-2019-10671
Ecosystem
Packagist
Packages
librenms/librenms
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-89
Reviewed
2019-09-25

Affected packages

• Packagist librenms/librenms: < 1.50.1 → fixed in 1.50.1

Description

An issue was discovered in LibreNMS through 1.47. It does not parameterize all user supplied input within database queries, resulting in SQL injection. An authenticated attacker can subvert these database queries to extract or manipulate data, as demonstrated by the graph.php sort parameter.

Related

Alias · CVE (1)

  • CVE-2019-10671 An issue was discovered in LibreNMS through 1.47. vulnerability

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References