PT-2023-30763 · Librenms · Librenms

Rook1337 · Published 2023-11-17 · Updated 2023-11-29 · CVE-2023-48294

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions LibreNMS versions prior to 23.11.0

Description The issue allows a low-privilege user to enumerate devices on LibreNMS with their id or hostname by accessing a request sent to graph.php when they access their device dashboard. This enables the low-privilege user to see all devices registered by admin users.

Recommendations For versions prior to 23.11.0, upgrade to release version 23.11.0 or later to address the vulnerability. As a temporary workaround, consider implementing privilege access control features to check if low-privilege users have access to specific devices or not. Restrict access to the graph.php endpoint to minimize the risk of exploitation. Avoid using the device parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2023-48294

GHSA-FPQ5-4VWM-78X4

Affected Products

Librenms

References · 11

• 🔥 https://github.com/librenms/librenms/security/advisories/GHSA-fpq5-4vwm-78x4 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/48xxx/CVE-2023-48294.json · Exploit
• https://github.com/librenms/librenms/commit/489978a923ed52aa243d3419889ca298a8a6a7cf · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-48294 · Security Note
• https://osv.dev/vulnerability/GHSA-fpq5-4vwm-78x4 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-48294 · Vendor Advisory
• https://github.com/librenms/librenms · Note
• https://github.com/librenms/librenms/blob/fa93034edd40c130c2ff00667ca2498d84be6e69/html/graph.php#L19C1-L25C2 · Note
• https://t.me/cvenotify/60644 · Telegram Post
• https://t.me/cvenotify/60687 · Telegram Post
• https://t.me/cvenotify/61537 · Telegram Post