CVE-2022-4068: Improperly Controlled Modification of Dynamically-Determined Object Attributes in librenms/librenms
A user is able to enable their own account if it was disabled by an admin while the user still holds a valid session. Moreover, the username is not properly sanitized in the admin user overview. This enables an XSS attack that enables an attacker with a low privilege user to execute arbitrary JavaScript in the context of an admin's account.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID of this vulnerability?
The vulnerability ID is CVE-2022-4068.
What is the severity of CVE-2022-4068?
The severity of CVE-2022-4068 is high.
How does CVE-2022-4068 impact the affected software?
CVE-2022-4068 allows a user to enable their own account if it was disabled by an admin while the user still holds a valid session, and also enables an XSS attack.
Which software is affected by CVE-2022-4068?
The software affected by CVE-2022-4068 is Librenms version up to 22.10.0.
How can I fix CVE-2022-4068?
To fix CVE-2022-4068, update Librenms to a version beyond 22.10.0 and ensure proper input sanitization for the username in the admin user overview.