Vulnerability · Published Nov 15, 2024 · Assigned by GitHub_M

CVE-2024-49758LibreNMS has a stored XSS in ExamplePlugin with Device's Notes

Medium 4.8

In plain English

A medium-severity cross-site scripting in librenms from librenms. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.8Medium

Exploit odds (30 days)0.4%top 70.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. User with Admin role can add Notes to a device, the application did not properly sanitize the user input, when the ExamplePlugin enable, if java script code is inside the device's Notes, its will be trigger. This vulnerability is fixed in 24.10.0.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	librenms/librenms	24.10.0	GHSA-c86q-rj37-8f85

Affected products (as reported)

Vendor	Product	Versions
librenms	librenms	< 24.10.0

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

References

https://github.com/librenms/librenms/security/advisories/GHSA-c86q-rj37-8f85 x_refsource_CONFIRM
https://github.com/librenms/librenms/commit/24b142d753898e273ec20b542a27dd6eb530c7d8 x_refsource_MISC