CVE-2022-29712: Command injection in librenms
Summary
CVE-2022-29712: Command injection in librenms. Affects librenms/librenms versions < 22.4.0. Fixed in 22.4.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
LibreNMS is an open-source network monitoring and management system. It provides a comprehensive platform for monitoring network devices, servers, and applications. LibreNMS v22.3.0 has been found to have multiple command injection vulnerabilities. These vulnerabilities can be exploited through the service_ip, hostname, and service_param parameters.
Vulnerability Detail
The command injection vulnerabilities in LibreNMS v22.3.0 allow an attacker to execute arbitrary commands on the system. By injecting malicious commands into the affected parameters, an attacker can gain unauthorized access, escalate privileges, or perform other malicious activities. This can lead to a complete compromise of the system and potential data breaches.
How To Fix
Minimum fixed version
22.4.0
This is the first release that contains the fix.
composer require librenms/librenms:22.4.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to upgrade to the fixed version as soon as possible to mitigate the risk of exploitation.
Conclusion
LibreNMS v22.3.0 contains command injection vulnerabilities that can be exploited to execute arbitrary commands on the system. Upgrading to version 22.4.0 or later is necessary to fix these vulnerabilities. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for librenms/librenms →
FAQ
LibreNMS is an open-source network monitoring and management system.
LibreNMS version 22.3.0 is affected by the command injection vulnerabilities.
The vulnerability can be exploited by injecting malicious commands into the service_ip, hostname, or service_param parameters.
The vulnerability can lead to unauthorized access, privilege escalation, and potential data breaches.
No, there is no known workaround. It is recommended to upgrade to the fixed version.
References
Related vulnerabilities
Recent vulnerabilities recorded for librenms/librenms.
