CVE-2019-10665
CVE-2019-10665
Здесь приведены факты из открытых источников об уязвимостях. Перед обновлением ознакомьтесь с исходным сообщением.
An issue was discovered in LibreNMS through 1.47. The scripts that handle the graphing options (html/includes/graphs/common.inc.php and html/includes/graphs/graphs.inc.php) do not sufficiently validate or encode several fields of user supplied input. Some parameters are filtered with mysqli_real_escape_string, which is only useful for preventing SQL injection attacks; other parameters are unfiltered. This allows an attacker to inject RRDtool syntax with newline characters via the html/graph.php script. RRDtool syntax is quite versatile and an attacker could leverage this to perform a number of attacks, including disclosing directory structure and filenames, file content, denial of service, or writing arbitrary files.
CVSS 9.8 · Критический · EPSS 1,5%
- Опубликовано
- Обновлено
Стек: php
Затронутые продукты и версии
n/a
- Версии
- n/a: Затронуто
Нет опубликованного исправления
librenms/librenms Packagist
- Версии
- 1.19
- 1.20
- 1.20.1
- 1.21
- 1.22
- 1.22.01
- 1.23
- 1.24
- 1.25
- 1.26
- 1.27
- 1.28
- 1.29
- 1.30
- 1.30.01
- 1.31
- 1.31.01
- 1.31.02
- 1.31.03
- 1.32
- 1.32.01
- 1.33
- 1.33.01
- 1.34
- 1.35
- 1.36
- 1.36.01
- 1.37
- 1.38
- 1.39
- 1.40
- 1.41
- 1.42
- 1.42.01
- 1.43
- 1.44
- 1.45
- 1.46
- 1.47
- Затронутые диапазоны версий
- ECOSYSTEM: ≤ 1.47
Нет опубликованного исправления