Vulnerability Description
An issue was discovered in LibreNMS through 1.47. There is a command injection vulnerability in html/includes/graphs/device/collectd.inc.php where user supplied parameters are filtered with the mysqli_escape_real_string function. This function is not the appropriate function to sanitize command arguments as it does not escape a number of command line syntax characters such as ` (backtick), allowing an attacker to inject commands into the variable $rrd_cmd, which gets executed via passthru().
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Librenms | Librenms | <= 1.47 |
Related Weaknesses (CWE)
References
- http://packetstormsecurity.com/files/154391/LibreNMS-Collectd-Command-Injection.ExploitThird Party AdvisoryVDB Entry
- https://www.darkmatter.ae/xen1thlabs/librenms-command-injection-vulnerability-xlExploitThird Party Advisory
- http://packetstormsecurity.com/files/154391/LibreNMS-Collectd-Command-Injection.ExploitThird Party AdvisoryVDB Entry
- https://www.darkmatter.ae/xen1thlabs/librenms-command-injection-vulnerability-xlExploitThird Party Advisory
FAQ
What is CVE-2019-10669?
CVE-2019-10669 is a vulnerability with a CVSS score of 7.2 (HIGH). An issue was discovered in LibreNMS through 1.47. There is a command injection vulnerability in html/includes/graphs/device/collectd.inc.php where user supplied parameters are filtered with the mysqli...
How severe is CVE-2019-10669?
CVE-2019-10669 has been rated HIGH with a CVSS base score of 7.2/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2019-10669?
Check the references section above for vendor advisories and patch information. Affected products include: Librenms Librenms.