Allocation of Resources Without Limits or Throttling Affecting librenms/librenms package, versions <23.11.0


0.0
medium

Snyk CVSS

    Attack Complexity Low

    Threat Intelligence

    Exploit Maturity Proof of concept
    EPSS 0.08% (35th percentile)
Expand this section
NVD
7.5 high

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-PHP-LIBRENMSLIBRENMS-6069812
  • published 19 Nov 2023
  • disclosed 17 Nov 2023
  • credit rook1337

How to fix?

Upgrade librenms/librenms to version 23.11.0 or higher.

Overview

librenms/librenms is a fully featured network monitoring system that provides a wealth of features and device support.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of rate limiting security feature at GET request or backend validation. An attacker can bruteforce user accounts by using GET request for authentication. This is only exploitable if the application is using two login methods and one of them is using GET request for authentication.