GHSA-62q7-qj6g-gvr7CriticalCVSS 9.8

LibreNMS arbitrary OS commands execution

Published
May 24, 2022
Last Modified
April 24, 2024

🔗 CVE IDs covered (1)

CVE-2018-20434 →

📋 Description

LibreNMS 1.46 allows remote attackers to execute arbitrary OS commands by using the $_POST['community'] parameter to html/pages/addhost.inc.php during creation of a new device, and then making a /ajax_output.php?id=capture&format=text&type=snmpwalk&hostname=localhost request that triggers html/includes/output/capture.inc.php command mishandling.

🎯 Affected products1

  • composer/librenms/librenms:= 1.46

🔗 References (5)