Improper Access Control Affecting librenms/librenms package, versions >=0.0.0


0.0
high

Snyk CVSS

    Attack Complexity Low
    Confidentiality High

    Threat Intelligence

    Exploit Maturity Proof of concept
    EPSS 0.28% (68th percentile)
Expand this section
NVD
8.8 high

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-PHP-LIBRENMSLIBRENMS-2401227
  • published 15 Feb 2022
  • disclosed 15 Feb 2022
  • credit Faisal Fs

How to fix?

A fix was pushed into the master branch but not yet published.

Overview

librenms/librenms is a fully featured network monitoring system that provides a wealth of features and device support.

Affected versions of this package are vulnerable to Improper Access Control. The port-groups functionality fails to enforce policy such that normal users could act outside of their intended permissions which are supposedly accessible by the Administrator only. This vulnerability allows attackers with normal role/level privileges to interact with port-groups functionalities such as create, edit/modify and delete.

Note:

Affected endpoints:

  1. GET http://{HOST}/port-groups - [view all port groups]

  2. POST http://{HOST}/port-groups - [create]

  3. POST http://{HOST}/port-groups/{port_id} - [edit]

  4. DELETE http://{HOST}/port-groups/{port_id} - [delete]