~ / search / GHSA-4fwh-r866-pvh9

GHSA-4fwh-r866-pvh9

LibreNMS SQL Injection

Source: GitHub Advisory Database (reviewed) High CVE-2018-20678

Packages

EcosystemPackageAffectedFixed in
Packagist librenms/librenms < 1.65 1.65

Details

As written in the advisory (Markdown source, shown as plain text).

LibreNMS through 1.47 allows SQL injection via the html/ajax_table.php sort[hostname] parameter, exploitable by authenticated users during a search.

References

External links from the advisory. They lead to third-party sites.