CVE-2018-20678 - LibreNMS through 1.47 allows SQL injection via the html/ajax_table.php sort[hostname] parameter, exploitable by authenticated users during a search

HIGH

LibreNMS through 1.47 allows SQL injection via the html/ajax_table.php sort[hostname] parameter, exploitable by authenticated users during a search

Published Mar 28, 2019

8.8

HIGH

CVSS 3.0

EPSS 1.38%

LibreNMS through 1.47 allows SQL injection via the html/ajax_table.php sort[hostname] parameter, exploitable by authenticated users during a search.

No remediation recorded yet.

Weaknesses (1)

CWE-89

SQL Injection

Link	Providers	Tags
https://cert.enea.pl/advisories/cert-190101.html		x_refsource_MISCThird Party Advisory
https://github.com/advisories/GHSA-4fwh-r866-pvh9		Advisory
https://github.com/librenms/librenms/commit/32f72bc1ab7e980e4070e826a89d0d36a5ba62dd
https://github.com/librenms/librenms/commits/master/html/ajax_table.php		x_refsource_MISCThird Party Advisory
https://github.com/librenms/librenms/pull/11920
https://nvd.nist.gov/vuln/detail/CVE-2018-20678