CVE-2020-15873

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2020-15873

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-15873.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2020-15873

Aliases

GHSA-g5r6-vrmx-9gwj

Published

2020-07-21T17:15:12.060Z

Modified

2026-07-08T12:05:38.208028Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

[none]

Details

In LibreNMS before 1.65.1, an authenticated attacker can achieve SQL Injection via the customoid.inc.php deviceid POST parameter to ajaxform.php.

References

Affected packages

Git / github.com/librenms/librenms

Affected ranges

Type

GIT

Repo

https://github.com/librenms/librenms

Events

Introduced

Fixed

15496dffd964a5033196550dcaef8c67e97e8b95

Fixed

8f3a29cde5bbd8608f9b42923a7d7e2598bcac4e

Database specific

{
    "cpe": "cpe:2.3:a:librenms:librenms:*:*:*:*:*:*:*:*",
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.65.1"
        }
    ]
}

Affected versions

0.*

0.1

1.*

1.19

1.20

1.21

1.25

1.26

1.27

1.28

1.31.01

1.31.02

1.31.03

1.32

1.33

1.35

1.36

1.37

1.38

1.39

1.40

1.41

1.42

1.42.01

1.43

1.44

1.45

1.46

1.47

1.48

1.48.1

1.49

1.50

1.51

1.52

1.53

1.53.1

1.54

1.55

1.56

1.57

1.58

1.58.1

1.59

1.60

1.61

1.62

1.63

1.64

1.64.1

1.65

Other

201505

201506

201507

201508

201509

201510

201511

201512

201601

201602

201603

201604

201605

201606

201607

201608

20160828

201609

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-15873.json"