Vulnerability · Published Jul 21, 2020 · Assigned by mitre
CVE-2020-15873
Medium 6.5
In plain English
A medium-severity security flaw in the librenms/librenms package (Packagist). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.2% (higher than 83% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)6.5Medium
Exploit odds (30 days)2.2%top 17.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Public PoC
Official description
In LibreNMS before 1.65.1, an authenticated attacker can achieve SQL Injection via the customoid.inc.php device_id POST parameter to ajax_form.php.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | librenms/librenms | 1.65.1 | GHSA-g5r6-vrmx-9gwj |
Affected products (as reported)
References
- https://research.loginsoft.com/bugs/blind-sql-injection-in-librenms/ x_refsource_MISC
- https://community.librenms.org/c/announcements x_refsource_MISC
- https://github.com/librenms/librenms/compare/1.65...1.65.1 x_refsource_MISC
- https://github.com/librenms/librenms/pull/11923 x_refsource_MISC
- https://github.com/librenms/librenms/commit/8f3a29cde5bbd8608f9b42923a7d7e2598bcac4e x_refsource_MISC