high7.1
CVE-2020-36947
LibreNMS contains an authenticated SQL Injection vulnerability
Impact
LibreNMS 1.46 contains an authenticated SQL Injection vulnerability in the MAC accounting graph endpoint that allows remote attackers to extract database information. Attackers can exploit the vulnerability by manipulating the 'sort' parameter with crafted SQL Injection techniques to retrieve sensitive database contents through time-based blind SQL Injection.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | librenms/librenms | <= 1.46 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Librenms | Librenms | Version 1.46 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://community.librenms.org/
- https://github.com/librenms/librenms
- https://www.exploit-db.com/exploits/49246
- https://www.librenms.org
- https://www.vulncheck.com/advisories/librenms-mac-accounting-graph-authenticated-sql-injection
- https://github.com/advisories/GHSA-qp2j-v5jg-hg68
- https://nvd.nist.gov/vuln/detail/CVE-2020-36947
- https://community.librenms.org