CVE-2019-10665: SQL Injection
First published: Mon Sep 09 2019(Updated: )
An issue was discovered in LibreNMS through 1.47. The scripts that handle the graphing options (`html/includes/graphs/common.inc.php` and `html/includes/graphs/graphs.inc.php`) do not sufficiently validate or encode several fields of user supplied input. Some parameters are filtered with `mysqli_real_escape_string`, which is only useful for preventing SQL injection attacks; other parameters are unfiltered. This allows an attacker to inject RRDtool syntax with newline characters via the `html/graph.php` script. RRDtool syntax is quite versatile and an attacker could leverage this to perform a number of attacks, including disclosing directory structure and filenames, file content, denial of service, or writing arbitrary files.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| composer/librenms/librenms | <=1.47 | |
| Librenms Librenms | <=1.47 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://nvd.nist.gov/vuln/detail/CVE-2019-10665
- https://www.darkmatter.ae/xen1thlabs/librenms-rrdtool-injection-vulnerability-xl-19-023/
- https://github.com/spaceraccoon/CVE-2020-10665
- https://www.activecyber.us/activelabs/docker-desktop-local-privilege-escalation-cve-2020-10665
- https://github.com/advisories/GHSA-q5rg-wg7h-73m5 (Advisory)
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2019-10665.
What is the severity level of CVE-2019-10665?
CVE-2019-10665 has a severity level of 9.8 (Critical).
What software versions are affected by CVE-2019-10665?
The following software versions are affected by CVE-2019-10665: LibreNMS up to and including version 1.47.
How can I fix CVE-2019-10665?
To fix CVE-2019-10665, update LibreNMS to version 1.48 or later.
What are some additional references for CVE-2019-10665?
Additional references for CVE-2019-10665 can be found at the following URLs: [Reference 1](https://nvd.nist.gov/vuln/detail/CVE-2019-10665), [Reference 2](https://www.darkmatter.ae/xen1thlabs/librenms-rrdtool-injection-vulnerability-xl-19-023/), [Reference 3](https://github.com/spaceraccoon/CVE-2020-10665).
- collector/github-advisory-latest
- alias/GHSA-q5rg-wg7h-73m5
- alias/CVE-2019-10665
- collector/nvd-index
- collector/nvd-cve
- agent/references
- agent/author
- agent/type
- agent/event
- agent/weakness
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- agent/severity
- agent/description
- agent/tags
- collector/mitre-cve
- source/MITRE
- package-manager/composer
- vendor/librenms
- canonical/librenms librenms
- version/librenms librenms/1.47