p PatchFirst

CVE-2019-12464

CVE-2019-12464

This page contains facts from public vulnerability sources. Check the original advisory before updating.

An issue was discovered in LibreNMS 1.50.1. An authenticated user can perform a directory traversal attack against the /pdf.php file with a partial filename in the report parameter, to cause local file inclusion resulting in code execution.

CVSS 7.5 · High · EPSS 2.2% · Fix available

Published
Updated

Stack: php

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • librenms/librenms Packagist

    Versions
    • 1.19
    • 1.20
    • 1.20.1
    • 1.21
    • 1.22
    • 1.22.01
    • 1.23
    • 1.24
    • 1.25
    • 1.26
    • 1.27
    • 1.28
    • 1.29
    • 1.30
    • 1.30.01
    • 1.31
    • 1.31.01
    • 1.31.02
    • 1.31.03
    • 1.32
    • 1.32.01
    • 1.33
    • 1.33.01
    • 1.34
    • 1.35
    • 1.36
    • 1.36.01
    • 1.37
    • 1.38
    • 1.39
    • 1.40
    • 1.41
    • 1.42
    • 1.42.01
    • 1.43
    • 1.44
    • 1.45
    • 1.46
    • 1.47
    • 1.48
    • 1.48.1
    • 1.49
    • 1.50
    • 1.50.1
    • 1.51
    • 1.52
    Affected ranges
    • ECOSYSTEM: < 1.53

    Update to 1.53

Original sources

Check your server →