CVE-2019-10665: LibreNMS Information Disclosure
Summary
CVE-2019-10665: LibreNMS Information Disclosure. Affects librenms/librenms versions < 1.47. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
LibreNMS is an open-source network monitoring and management system. It provides a comprehensive set of features for monitoring network devices, collecting performance data, and generating graphs and reports. LibreNMS is widely used in various environments to monitor and manage network infrastructure.
Vulnerability Detail
The vulnerability identified as CVE-2019-10665 affects LibreNMS versions up to 1.47. The issue lies in the handling of user-supplied input in the graphing options scripts (common.inc.php and graphs.inc.php). Insufficient validation and encoding of certain fields allow an attacker to inject RRDtool syntax with newline characters via the graph.php script. This can lead to various attacks, including information disclosure, directory traversal, denial of service, and arbitrary file writing. The vulnerability is rated as critical with a CVSS score of 9.8.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. Upgrading to the patched version is the recommended solution.
Conclusion
The vulnerability in LibreNMS (CVE-2019-10665) allows an attacker to inject malicious RRDtool syntax, potentially leading to various attacks. It is crucial to upgrade to the patched version (1.48 or later) to mitigate the risk of exploitation. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for librenms/librenms →
FAQ
LibreNMS is an open-source network monitoring and management system used to monitor network devices and collect performance data.
The vulnerability allows an attacker to inject malicious RRDtool syntax, potentially leading to information disclosure, directory traversal, denial of service, or arbitrary file writing.
To fix the vulnerability, you should upgrade your LibreNMS installation to version 1.48 or later.
No specific workaround is available. Upgrading to the patched version is the recommended solution.
The vulnerability is rated as critical with a CVSS score of 9.8.
Related vulnerabilities
Recent vulnerabilities recorded for librenms/librenms.
