-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| librenms/librenms | composer | < 25.11.0 | 25.11.0 |
Miggo AIRoot Cause AnalysisThe vulnerability was caused by a weak and inconsistently applied password policy across different user management functions in LibreNMS. The application failed to enforce strong password requirements, allowing administrators to set trivial passwords for user accounts. The analysis of the patch between the vulnerable version (25.10.0) and the patched version (25.11.0) revealed that the fix involved centralizing the password policy using Laravel's Password::defaults() functionality. This new, stronger policy was then applied to all user creation and password update pathways.
The identified vulnerable functions are the exact points where password data is processed and validated. Before the patch, these functions either had no password strength validation or only checked for a minimum length. The patch modifies these specific functions to enforce the new, secure password policy.
App\Http\Controllers\Install\MakeUserController::create: Handles the initial admin user creation during setup. It was vulnerable as it only required a password to be present.App\Http\Requests\StoreUserRequest::rules: Defines validation for new user creation via the web UI. It was vulnerable due to only checking for minimum password length.App\Http\Requests\UpdateUserRequest::rules: Defines validation for user password changes. It was also vulnerable by only checking for minimum length.App\Console\Commands\AddUserCommand::handle: Manages user creation from the command line and previously had no password strength validation at all.By identifying these specific functions, a security engineer can confirm if their runtime environment is affected by monitoring these exact methods for invocations that could indicate exploitation or insecure configurations.
App\Http\Controllers\Install\MakeUserController::createapp/Http/Controllers/Install/MakeUserController.php
App\Http\Requests\StoreUserRequest::rulesapp/Http/Requests/StoreUserRequest.php
App\Http\Requests\UpdateUserRequest::rulesapp/Http/Requests/UpdateUserRequest.php
App\Console\Commands\AddUserCommand::handleapp/Console/Commands/AddUserCommand.php