Information Exposure Affecting librenms/librenms package, versions <23.11.0
Threat Intelligence
Exploit Maturity
Proof of concept
EPSS
0.05% (21st
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PHP-LIBRENMSLIBRENMS-6069814
- published 19 Nov 2023
- disclosed 17 Nov 2023
- credit rook1337
Introduced: 17 Nov 2023
CVE-2023-48294 Open this link in a new tabHow to fix?
Upgrade librenms/librenms to version 23.11.0 or higher.
Overview
librenms/librenms is a fully featured network monitoring system that provides a wealth of features and device support.
Affected versions of this package are vulnerable to Information Exposure due to the Graphs feature, an attacker can bypass access control and view all devices registered by admin users by manipulating the device parameter in the URL. This is only exploitable if the attacker has authenticated user access.
References
CVSS Scores
version 3.1