CVE-2021-44278: Path traversal vulnerability in librenms/librenms
Summary
CVE-2021-44278: Path traversal in librenms/librenms. Affects librenms/librenms versions < 21.11.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Librenms is an open-source network monitoring and management tool. It provides a comprehensive platform for monitoring network devices, collecting performance data, and generating alerts. The librenms/librenms package is a core component of the Librenms system, responsible for handling various functionalities related to device configuration. Unfortunately, version 21.11.0 of Librenms is affected by a critical path traversal vulnerability in the includes/html/pages/device/showconfig.inc.php file.
Vulnerability Detail
The path traversal vulnerability in Librenms 21.11.0 allows an attacker to manipulate file paths and access arbitrary files on the system. By exploiting this vulnerability, an attacker can potentially read sensitive files, modify configurations, or execute arbitrary code. This can lead to unauthorized access, data leakage, or even complete compromise of the affected system. The vulnerability has a CVSS score of 9.8, indicating its high severity.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can apply access restrictions to the vulnerable file (showconfig.inc.php) to limit its accessibility. This can be achieved by modifying the file permissions or implementing access control rules at the web server level. However, applying the workaround is not a permanent solution, and upgrading to a patched version is strongly recommended.
Conclusion
The path traversal vulnerability in Librenms 21.11.0 poses a significant risk to the security and integrity of affected systems. It is crucial to promptly upgrade to a patched version of Librenms beyond 21.11.0 to mitigate this vulnerability. Additionally, implementing proper access controls and file permissions is essential to prevent unauthorized access. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for librenms/librenms →
FAQ
Librenms is an open-source network monitoring and management tool that provides a comprehensive platform for monitoring network devices, collecting performance data, and generating alerts.
The path traversal vulnerability in Librenms allows an attacker to access arbitrary files on the system, potentially leading to unauthorized access, data leakage, or complete compromise of the affected system.
To fix this vulnerability, it is recommended to upgrade to a patched version of Librenms beyond 21.11.0. Additionally, ensure proper access controls and file permissions are in place.
As a temporary workaround, users can apply access restrictions to the vulnerable file (showconfig.inc.php) by modifying file permissions or implementing access control rules at the web server level. However, upgrading to a patched version is strongly recommended.
The CVSS score of this vulnerability is 9.8, indicating its high severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for librenms/librenms.
