GHSA-3c33-3465-fhx2

Source

https://github.com/advisories/GHSA-3c33-3465-fhx2

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/09/GHSA-3c33-3465-fhx2/GHSA-3c33-3465-fhx2.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-3c33-3465-fhx2

Aliases

CVE-2020-15877

Published

2021-09-08T17:27:16Z

Modified

2023-11-08T04:02:38.333967Z

Severity

8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Exposure of Resource to Wrong Sphere in LibreNMS

Details

An issue was discovered in LibreNMS before 1.65.1. It has insufficient access control for normal users because of "'guard' => 'admin'" instead of "'middleware' => ['can:admin']" in routes/web.php.

Database specific

{
    "nvd_published_at": "2020-07-21T17:15:00Z",
    "github_reviewed_at": "2021-07-26T19:20:01Z",
    "severity": "HIGH",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-668"
    ]
}

References

Affected packages

Packagist / librenms/librenms

Package

Name: librenms/librenms
Purl: pkg:composer/librenms/librenms

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.65.1

Affected versions

1.*

1.19

1.20

1.20.1

1.21

1.22

1.22.01

1.23

1.24

1.25

1.26

1.27

1.28

1.29

1.30

1.30.01

1.31

1.31.01

1.31.02

1.31.03

1.32

1.32.01

1.33

1.33.01

1.34

1.35

1.36

1.36.01

1.37

1.38

1.39

1.40

1.41

1.42

1.42.01

1.43

1.44

1.45

1.46

1.47

1.48

1.48.1

1.49

1.50

1.50.1

1.51

1.52

1.53

1.53.1

1.54

1.55

1.56

1.57

1.58

1.58.1

1.59

1.60

1.61

1.62

1.62.1

1.62.2

1.63

1.64

1.64.1

1.65