Homepage
About Snyk

Authentication Bypass Affecting librenms/librenms package, versions <1.50.1

0.0
high

Snyk CVSS

    Attack Complexity Low
    Scope Changed
    Integrity High

    Threat Intelligence

    Exploit Maturity Proof of concept
    EPSS 0.41% (74th percentile)
Expand this section
NVD
9.1 critical

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-PHP-LIBRENMSLIBRENMS-466416
  • published 9 Sep 2019
  • disclosed 9 Sep 2019
  • credit Eldar Marcussen
Report a new vulnerability Found a mistake?

Introduced: 9 Sep 2019

CVE-2019-10668 Open this link in a new tab
CWE-287 Open this link in a new tab

How to fix?

Upgrade librenms/librenms to version 1.50.1 or higher.

Overview

librenms/librenms is a fully featured network monitoring system that provides a wealth of features and device support.

Affected versions of this package are vulnerable to Authentication Bypass. Multiple LibreNMS scripts do not correctly enforce or completely lacks authentication checks. Attackers can take advantage of this to access several scripts, including some that suffer from additional vulnerabilities. This vulnerability can be combined with other vulnerabilities could be used to achieve unauthenticated remote code execution.