CVE-2022-4068 | Improperly Controlled Modification of Dynamically-Determined Object Attributes in librenms/librenms
Exp
A user is able to enable their own account if it was disabled by an admin while the user still holds a valid session. Moreover, the username is not properly sanitized in the admin user overview. This enables an XSS attack that enables an attacker with a low privilege user to execute arbitrary JavaScript in the context of an admin's account.
Conclusion & alert: CVE-2022-4068 is rated High Exploit Risk (67.3/100): CVSS Medium severity, with high exploitation likelihood (EPSS 50.25%, 98th percentile).Core evidence: 1 public exploit reference(s) are indexed (Exploit-DB).Mandatory action: Public exploits are available—assess exposure, apply mitigations, and prioritize patching.
Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.
Public exploit references (Exploit-DB) for CVE-2022-4068
Exploit prediction scoring system (EPSS) score for CVE-2022-4068
EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).