PT-2019-11983

Name of the Vulnerable Software and Affected Versions LibreNMS versions prior to 1.48 Description An issue in LibreNMS allows unsafe data to be injected into HTML or JavaScript contexts due to ineffective filtering of user-supplied input using the mysqli escape real string function. This can lead...

PT-2019-11978

Name of the Vulnerable Software and Affected Versions LibreNMS versions 1.47 and earlier Description The issue arises from insufficient validation or encoding of user-supplied input in the scripts handling graphing options, specifically in html/includes/graphs/common.inc.php and...

PT-2019-11980

Name of the Vulnerable Software and Affected Versions LibreNMS versions prior to 1.48 Description An issue in LibreNMS allows information disclosure, enabling an attacker to fingerprint the exact code version installed and disclose local file paths. Recommendations For versions prior to 1.48,...

PT-2019-11982

Name of the Vulnerable Software and Affected Versions LibreNMS versions prior to 1.48 Description A command injection issue exists due to improper filtering of user-supplied parameters in the html/includes/graphs/device/collectd.inc.php file. The mysqli escape real string function is used, which...

PT-2019-12809

Name of the Vulnerable Software and Affected Versions LibreNMS version 1.50.1 Description An issue was discovered that allows an authenticated user to perform a directory traversal attack against the "pdf.php" file. This is achieved by providing a partial filename in the report parameter, leading...

PT-2019-12808

Name of the Vulnerable Software and Affected Versions LibreNMS version 1.50.1 Description The issue arises from insufficient validation or encoding of user-supplied input in scripts handling graphing options. Specifically, the includes/html/graphs/common.inc.php and...

PT-2019-12810

Name of the Vulnerable Software and Affected Versions LibreNMS version 1.50.1 Description A SQL injection issue was found, identified in the ajax rulesuggest.php file. The term parameter is used insecurely in a database query for showing columns of a table. This can be demonstrated by a request t...

PT-2019-11979

Name of the Vulnerable Software and Affected Versions LibreNMS versions through 1.47 Description An issue was discovered in LibreNMS where several scripts perform dynamic script inclusion via the include function on user-supplied input without sanitizing the values. This allows an attacker to...

PT-2019-11984

Name of the Vulnerable Software and Affected Versions LibreNMS versions prior to 1.48 Description The issue allows SQL injection due to insufficient parameterization of user-supplied input within database queries. An authenticated attacker can manipulate these database queries to extract or modif...

CVE-2019-10671: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in LibreNMS through 1.47. It does not parameterize all user supplied input within database queries, resulting in SQL injection. An authenticated attacker can subvert these database queries to extract or manipulate data, as demonstrated by the graph.php sort parameter...

CVE-2019-10669: Improper Neutralization of Special Elements used in an OS Command

An issue was discovered in LibreNMS through 1.47. There is a command injection vulnerability in html/includes/graphs/device/collectd.inc.php where user supplied parameters are filtered with the mysqliescaperealstring function. This function is not the appropriate function to sanitize command...

CVE-2019-10670: Improper Neutralization of Input During Web Page Generation

An issue was discovered in LibreNMS through 1.47. Many of the scripts rely on the function mysqliescaperealstring for filtering data. However, this is particularly ineffective when returning user supplied input in an HTML or a JavaScript context, resulting in unsafe data being injected into these...

CVE-2019-12465: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in LibreNMS 1.50.1. A SQL injection flaw was identified in the ajaxrulesuggest.php file where the term parameter is used insecurely in a database query for showing columns of a table, as demonstrated by an ajaxrulesuggest.php?debug=1&term= request...

CVE-2019-12464: Improper Limitation of a Pathname to a Restricted Directory

An issue was discovered in LibreNMS 1.50.1. An authenticated user can perform a directory traversal attack against the /pdf.php file with a partial filename in the report parameter, to cause local file inclusion resulting in code execution...

CVE-2019-10667: Exposure of Sensitive Information to an Unauthorized Actor

An issue was discovered in LibreNMS through 1.47. Information disclosure can occur: an attacker can fingerprint the exact code version installed and disclose local file paths...

CVE-2019-12463: Improper Neutralization of Special Elements in Output Used by a Downstream Component

An issue was discovered in LibreNMS 1.50.1. The scripts that handle graphing options includes/html/graphs/common.inc.php and includes/html/graphs/graphs.inc.php do not sufficiently validate or encode several fields of user supplied input. Some parameters are filtered with mysqlirealescapestring,...

CVE-2019-10668: Missing Authentication for Critical Function

An issue was discovered in LibreNMS through 1.47. A number of scripts import the Authentication libraries, but do not enforce an actual authentication check. Several of these scripts disclose information or expose functions that are of a sensitive nature and are not expected to be publicly...

CVE-2019-10666: Inclusion of Functionality from Untrusted Control Sphere

An issue was discovered in LibreNMS through 1.47. Several of the scripts perform dynamic script inclusion via the include function on user supplied input without sanitizing the values by calling basename or a similar function. An attacker can leverage this to execute PHP code from the included...

CVE-2019-10665: Improper Neutralization of Special Elements in Output Used by a Downstream Component

An issue was discovered in LibreNMS through 1.47. The scripts that handle the graphing options html/includes/graphs/common.inc.php and html/includes/graphs/graphs.inc.php do not sufficiently validate or encode several fields of user supplied input. Some parameters are filtered with...

LibreNMS Collectd Command Injection

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'LibreNMS Collectd Command Injection', 'Description' = %q This module exploits a command injection vulnerability in the Collectd graphing...