CVE-2020-36947: LibreNMS 1.46 - MAC Accounting Graph Authenticated SQL Injection
LibreNMS 1.46 contains an authenticated SQL injection vulnerability in the MAC accounting graph endpoint that allows remote attackers to extract database information. Attackers can exploit the vulnerability by manipulating the 'sort' parameter with crafted SQL injection techniques to retrieve sensitive database contents through time-based blind SQL injection.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2020-36947?
CVE-2020-36947 is classified as a critical severity vulnerability due to its potential for remote exploitation and data exposure.
How do I fix CVE-2020-36947?
To mitigate CVE-2020-36947, upgrade LibreNMS to the latest version where the SQL injection vulnerability has been patched.
What type of vulnerability is CVE-2020-36947?
CVE-2020-36947 is an authenticated SQL injection vulnerability affecting the MAC accounting graph endpoint in LibreNMS.
Who is affected by CVE-2020-36947?
LibreNMS users running version 1.46 are affected by CVE-2020-36947 and should take immediate action to secure their installations.
What can attackers do with CVE-2020-36947?
Attackers exploiting CVE-2020-36947 can extract sensitive database information by manipulating queries through the MAC accounting graph endpoint.