GHSA-qp2j-v5jg-hg68

LibreNMS contains an authenticated SQL Injection vulnerability

Source: GitHub Advisory Database (reviewed) High CVE-2020-36947

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	librenms/librenms	<= 1.46	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

LibreNMS 1.46 contains an authenticated SQL Injection vulnerability in the MAC accounting graph endpoint that allows remote attackers to extract database information. Attackers can exploit the vulnerability by manipulating the 'sort' parameter with crafted SQL Injection techniques to retrieve sensitive database contents through time-based blind SQL Injection.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2020-36947 advisory
https://community.librenms.org web
https://github.com/librenms/librenms package
https://www.exploit-db.com/exploits/49246 web
https://www.vulncheck.com/advisories/librenms-mac-accounting-graph-authenticated-sql-injection web