CVE-2019-10665 LibreNMS Information Disclosure
Attackers can inject RRDtool syntax via graph parameters in LibreNMS to execute commands, read files, or cause denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-10665?
CVE-2019-10665 is a critical command injection vulnerability in Librenms Librenms, published on 9 Sep 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in LibreNMS through 1.47. The scripts that handle the graphing options (html/includes/graphs/common.inc.php and html/includes/graphs/graphs.inc.php) do not sufficiently validate or encode several fields of user supplied input. Some parameters are filtered with mysqli_real_escape_string, which is only useful for preventing SQL injection attacks; other parameters are unfiltered. This allows an attacker to inject RRDtool syntax with newline characters via the html/graph.php script. RRDtool syntax is quite versatile and an attacker could leverage this to perform a number of attacks, including disclosing directory structure and filenames, file content, denial of service, or writing arbitrary files.
Weakness: CWE-74
Which versions are affected by CVE-2019-10665?
2 open source packages ship an affected version, including librenms/librenms. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
librenms/librenms Packagist | All versions to 1.47 | None |
librenms/librenms Packagist | All versions to 1.47 | None |
Products include Librenms Librenms.
How do I fix CVE-2019-10665?
No fix has been published for CVE-2019-10665 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2019-10665 being exploited?
There is no known exploitation of CVE-2019-10665 in the wild and no public exploit code.
Other vulnerabilities in Librenms Librenms
- CVE-2023-4982 Cross-site Scripting (XSS) - Stored in librenms/librenms
- CVE-2022-29712 Command injection in librenms
- CVE-2021-44278 Path traversal in librenms/librenms
- CVE-2018-20434 LibreNMS arbitrary OS commands execution
- CVE-2026-26988 LibreNMS: SQL Injection in ajax_table.php spreads through a covert data stream
Sources
Also known as GHSA-q5rg-wg7h-73m5.