CVE-2019-10671: SQL Injection
An issue was discovered in LibreNMS through 1.47. It does not parameterize all user supplied input within database queries, resulting in SQL injection. An authenticated attacker can subvert these database queries to extract or manipulate data, as demonstrated by the graph.php sort parameter.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2019-10671?
CVE-2019-10671 is a SQL injection vulnerability in LibreNMS through version 1.47.
How does CVE-2019-10671 affect LibreNMS?
CVE-2019-10671 allows an authenticated attacker to perform SQL injection attacks on LibreNMS, potentially extracting or manipulating data.
What is the severity of CVE-2019-10671?
The severity of CVE-2019-10671 is rated as high with a CVSS score of 8.8.
How can I fix CVE-2019-10671?
To fix CVE-2019-10671, you should upgrade LibreNMS to version 1.48 or later, which includes a patch for the vulnerability.
Where can I find more information about CVE-2019-10671?
You can find more information about CVE-2019-10671 at the following link: [https://www.darkmatter.ae/xen1thlabs/librenms-multiple-sql-injection-vulnerability-xl-19-025/](https://www.darkmatter.ae/xen1thlabs/librenms-multiple-sql-injection-vulnerability-xl-19-025/)