CVE-2022-4068 - CVE House
Back to Database
Status published High CVE-2022-4068

Improperly Controlled Modification of Dynamically-Determined Object Attributes in librenms/librenms

Vulnerability Description

A user is able to enable their own account if it was disabled by an admin while the user still holds a valid session. Moreover, the username is not properly sanitized in the admin user overview. This enables an XSS attack that enables an attacker with a low privilege user to execute arbitrary JavaScript in the context of an admin's account.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-4068

Credits & Attribution

No credits recorded in the NVD database.

References

More from librenms

View All →
CVE-2025-68614
LibreNMS Alert Rule API Cross-Site Scripting Vulnerability
Medium 4.3
CVE-2025-65093
LibreNMS is vulnerable to SQL Injection (Boolean-Based Blind) in hostname parameter in ajax_output.php endpoint
Medium 5.5
CVE-2025-65014
LibreNMS has Weak Password Policy
Low 3.7
CVE-2025-65013
LibreNMS vulnerable to Reflected Cross-Site Scripting (XSS) in endpoint `/maps/nodeimage` parameter `Image Name`
Medium 6.2
CVE-2025-62412
LibreNMS alert-rules Cross-Site Scripting Vulnerability
Low 3.8

Affected Vendor

Affected Software

librenms/librenms
Vulnerable Versions:
unspecified

Timeline

Official Publish: November 20th, 2022
Last Modified: April 25th, 2025
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L

Weaknesses (CWE)

CWE-915

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.