CVE-2023-46745

Rate limiting Bypass on login page in libreNMS

State: Published
Severity: 5.3 Medium
Published: Nov 17, 2023
Updated: Aug 29, 2024
Reserved: Oct 25, 2023

Description

LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring which includes support for a wide range of network hardware and operating systems. In affected versions the login method has no rate limit. An attacker may be able to leverage this vulnerability to gain access to user accounts. This issue has been addressed in version 23.11.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Scores

CVSS	Score	Vector	Source
3.1	5.3 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	GitHub_M

Weaknesses

CWE-307 Improper Restriction of Excessive Authentication Attempts

Affected Products

Product	Versions
librenmslibrenms	< 23.11.0Affected

References

https://github.com/librenms/librenms/security/advisories/GHSA-rq42-58qf-v3qx

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.