CVE-2017-16759: Path Traversal
First published: Thu Nov 09 2017(Updated: )
The installation process in LibreNMS before 2017-08-18 allows remote attackers to read arbitrary files, related to html/install.php.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| composer/librenms/librenms | <2017-08-18 | 2017-08-18 |
| Librenms Librenms | <=1.30 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://nvd.nist.gov/vuln/detail/CVE-2017-16759
- https://github.com/librenms/librenms/pull/7184
- https://github.com/librenms/librenms/commit/7887b2e1c7158204ac69ca43beafce66e4d3a3b4
- https://github.com/librenms/librenms/commit/d3094fa6578b29dc34fb5a7d0bd6deab49ecc911
- https://blog.librenms.org/2017/08/22/librenms-security-fix-during-the-installation-process/
- https://github.com/advisories/GHSA-4ccx-wjqp-5fww (Advisory)
Frequently Asked Questions
What is CVE-2017-16759?
CVE-2017-16759 is a vulnerability in the installation process of LibreNMS before 2017-08-18 that allows remote attackers to read arbitrary files.
How can remote attackers exploit CVE-2017-16759?
Remote attackers can exploit CVE-2017-16759 by manipulating the installation process in LibreNMS to read arbitrary files.
What is the severity of CVE-2017-16759?
CVE-2017-16759 has a severity rating of medium with a CVSS score of 5.9.
How do I determine if I am affected by CVE-2017-16759?
You are affected by CVE-2017-16759 if you are using a version of LibreNMS before 2017-08-18 or if you are using LibreNMS version 1.30.
How do I fix CVE-2017-16759?
To fix CVE-2017-16759, update your LibreNMS installation to version 2017-08-18 or later.
- collector/github-advisory
- alias/GHSA-4ccx-wjqp-5fww
- alias/CVE-2017-16759
- collector/github-advisory-latest
- collector/nvd-index
- collector/nvd-cve
- agent/references
- agent/severity
- agent/author
- agent/weakness
- agent/tags
- agent/type
- agent/event
- agent/description
- agent/remedy
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- package-manager/composer
- vendor/librenms
- canonical/librenms librenms
- version/librenms librenms/1.30