LibreNMS SQL Injection Vulnerability in librenms/librenms
Summary
CVE-2020-15873: LibreNMS SQL Injection vulnerability. Affects librenms/librenms versions < 1.65.1. Fixed in 1.65.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
LibreNMS is an open-source network monitoring and management tool. It provides a comprehensive set of features for monitoring network devices, collecting performance data, and generating alerts. The librenms/librenms package is the core component of LibreNMS, responsible for handling device data and interactions. Unfortunately, this package is vulnerable to a SQL Injection attack.
Vulnerability Detail
The SQL Injection vulnerability in LibreNMS before version 1.65.1 allows an authenticated attacker to exploit the customoid.inc.php file by manipulating the device_id parameter in the POST request to ajax_form.php. By injecting malicious SQL code, an attacker can execute unauthorized database queries, potentially gaining unauthorized access to sensitive information or modifying the database. This vulnerability has a CVSS score of 6.5, indicating a moderate severity level.
How To Fix
Minimum fixed version
1.65.1
This is the first release that contains the fix.
composer require librenms/librenms:1.65.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround is to disable the affected functionality or implement input validation and sanitization measures to prevent SQL Injection attacks. It is crucial to thoroughly review and test any custom modifications or workarounds to ensure they effectively mitigate the vulnerability without introducing new security risks.
Conclusion
The SQL Injection vulnerability in the librenms/librenms package of LibreNMS can be exploited by an authenticated attacker to execute unauthorized database queries. To mitigate this vulnerability, it is crucial to upgrade to LibreNMS version 1.65.1 or later. Alternatively, implementing input validation and sanitization measures can serve as a temporary workaround. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for librenms/librenms →
FAQ
LibreNMS is an open-source network monitoring and management tool that provides comprehensive features for monitoring network devices, collecting performance data, and generating alerts.
SQL Injection is a type of security vulnerability that allows an attacker to manipulate SQL queries by injecting malicious SQL code. This can lead to unauthorized access to sensitive information or modification of the database.
The SQL Injection vulnerability in LibreNMS allows an authenticated attacker to execute unauthorized database queries, potentially gaining access to sensitive information or modifying the database.
This vulnerability has a CVSS score of 6.5, indicating a moderate severity level.
To fix this vulnerability, it is recommended to upgrade to LibreNMS version 1.65.1 or later. This version includes a patch that prevents the SQL Injection attack.
References
Related vulnerabilities
Recent vulnerabilities recorded for librenms/librenms.
