Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTI3N3YtZ3dmci1obXBq

Missing Authentication for Critical Function in LibreNMS

An issue was discovered in LibreNMS through 1.47. A number of scripts import the Authentication libraries, but do not enforce an actual authentication check. Several of these scripts disclose information or expose functions that are of a sensitive nature and are not expected to be publicly accessible.

Permalink: https://github.com/advisories/GHSA-277v-gwfr-hmpj
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTI3N3YtZ3dmci1obXBq
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: over 4 years ago
Updated: about 1 year ago

CVSS Score: 9.1
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Identifiers: GHSA-277v-gwfr-hmpj, CVE-2019-10668
References:

• https://nvd.nist.gov/vuln/detail/CVE-2019-10668
• https://www.darkmatter.ae/xen1thlabs/librenms-authentication-bypass-vulnerability-xl-19-016/
• https://github.com/advisories/GHSA-277v-gwfr-hmpj

Blast Radius: 2.7

Affected Packages