CVE-2022-4070 Insufficient Session Expiration in librenms/librenms
Attackers can hijack user sessions due to insufficient expiration, potentially gaining unauthorized access to the LibreNMS network monitoring platform.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-4070?
CVE-2022-4070 is a low-severity vulnerability in Librenms Librenms, published on 20 Nov 2022. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Insufficient Session Expiration in GitHub repository librenms/librenms prior to 22.10.0.
Weakness: CWE-613
Which versions are affected by CVE-2022-4070?
2 open source packages ship an affected version, including librenms/librenms. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
librenms/librenms Packagist | All versions | 22.10.0 |
librenms/librenms Packagist | All versions | 22.10.0 |
Products include Librenms Librenms.
How do I fix CVE-2022-4070?
Upgrade librenms/librenms to 22.10.0 or later.
Is CVE-2022-4070 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-4070 exists.
Other vulnerabilities in Librenms Librenms
Sources
Also known as GHSA-x93j-3hh3-6x23.