CVE-2022-4068
Published: 20 November 2022
Summary
CVE-2022-4068 is a medium-severity Improperly Controlled Modification of Dynamically-Determined Object Attributes (CWE-915) vulnerability in Librenms Librenms. Its CVSS base score is 5.4 (Medium).
Operationally, ranked in the top 2.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
CVE-2022-4068 affects LibreNMS and stems from two related issues: an authenticated user whose account has been disabled by an administrator can still re-enable the account while holding a valid session, and usernames supplied to the administrative user overview are not sanitized before rendering. These flaws are tracked under CWE-915 and CWE-79 and carry a CVSS 3.1 score of 5.4.
A low-privileged user who retains a session can therefore restore their own access and, by supplying a crafted username, trigger stored cross-site scripting that executes arbitrary JavaScript in the context of an administrator account viewing the user list.
Public references point to patches merged in LibreNMS commits 09a2977adb8bc4b1db116c725d661160c930d3a1 that address both the account-reactivation logic and the missing output encoding. The associated huntr.dev report documents the same issues and confirms the fixes.
EPSS for the CVE currently stands at 0.5025 with a recorded peak of 0.5437.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-7322
Vulnerability details
A user is able to enable their own account if it was disabled by an admin while the user still holds a valid session. Moreover, the username is not properly sanitized in the admin user overview. This enables an XSS…
more
attack that enables an attacker with a low privilege user to execute arbitrary JavaScript in the context of an admin's account.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Penetration testing submits XSS payloads to web applications, detecting cross-site scripting flaws for subsequent remediation.
Validates web inputs to reject script-related content that could produce XSS.
Output validation against expected content can reject or sanitize script content in generated web pages, reducing XSS exploitability.