Improper Access Control Affecting librenms/librenms package, versions >=0.0.0
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PHP-LIBRENMSLIBRENMS-2401227
- published 15 Feb 2022
- disclosed 15 Feb 2022
- credit Faisal Fs
Introduced: 15 Feb 2022
CVE-2022-0580 Open this link in a new tabHow to fix?
A fix was pushed into the master branch but not yet published.
Overview
librenms/librenms is a fully featured network monitoring system that provides a wealth of features and device support.
Affected versions of this package are vulnerable to Improper Access Control. The port-groups functionality fails to enforce policy such that normal users could act outside of their intended permissions which are supposedly accessible by the Administrator only.
This vulnerability allows attackers with normal role/level privileges to interact with port-groups functionalities such as create, edit/modify and delete.
Note:
Affected endpoints:
GET http://{HOST}/port-groups - [view all port groups]
POST http://{HOST}/port-groups - [create]
POST http://{HOST}/port-groups/{port_id} - [edit]
DELETE http://{HOST}/port-groups/{port_id} - [delete]