CVE-2023-48294: Broken Access control on Graphs Feature in LibreNMS
First published: Fri Nov 17 2023(Updated: )
LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring which includes support for a wide range of network hardware and operating systems. In affected versions of LibreNMS when a user accesses their device dashboard, one request is sent to `graph.php` to access graphs generated on the particular Device. This request can be accessed by a low privilege user and they can enumerate devices on librenms with their id or hostname. Leveraging this vulnerability a low privilege user can see all devices registered by admin users. This vulnerability has been addressed in commit `489978a923` which has been included in release version 23.11.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Credit: security-advisories@github.com security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| composer/librenms/librenms | <23.11.0 | 23.11.0 |
| Librenms Librenms | <23.11.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/librenms/librenms/security/advisories/GHSA-fpq5-4vwm-78x4
- https://github.com/librenms/librenms/commit/489978a923ed52aa243d3419889ca298a8a6a7cf
- https://github.com/librenms/librenms/blob/fa93034edd40c130c2ff00667ca2498d84be6e69/html/graph.php#L19C1-L25C2
- https://nvd.nist.gov/vuln/detail/CVE-2023-48294
- https://github.com/advisories/GHSA-fpq5-4vwm-78x4 (Advisory)
Frequently Asked Questions
What is the severity of CVE-2023-48294?
The severity of CVE-2023-48294 is medium with a CVSS score of 4.3.
How does the broken access control vulnerability in LibreNMS affect users?
The broken access control vulnerability in LibreNMS allows unauthorized users to access any feature of the application.
Which version of LibreNMS is affected by CVE-2023-48294?
LibreNMS version 23.11.0 and earlier are affected by CVE-2023-48294.
How can I fix the broken access control vulnerability in LibreNMS?
To fix the broken access control vulnerability in LibreNMS, update to version 23.11.0 or later.
What is the Common Weakness Enumeration (CWE) ID for CVE-2023-48294?
The Common Weakness Enumeration (CWE) ID for CVE-2023-48294 is CWE-200.
- collector/mitre-cve
- collector/github-advisory-latest
- alias/GHSA-fpq5-4vwm-78x4
- alias/CVE-2023-48294
- collector/nvd-cve
- collector/github-advisory
- collector/nvd-api
- agent/title
- agent/severity
- agent/references
- agent/author
- agent/type
- package-manager/composer
- vendor/librenms
- canonical/librenms librenms