CVE-2024-47525
published 2024-10-01CVE-2024-47525: LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the "Alert Rules" feature…
PriorityP337medium5.4CVSS 3.1
AVNACLPRLUIRSCCLILAN
EPSS
26.24%
97.7th percentile
LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the "Alert Rules" feature allows authenticated users to inject arbitrary JavaScript through the "Title" field. This vulnerability can lead to the execution of malicious code in the context of other users' sessions, potentially compromising their accounts and allowing unauthorized actions. This vulnerability is fixed in 24.9.0.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| librenms | librenms | < 24.9.0 | 24.9.0 |
| librenms | librenms | >= 0 < 24.9.0 | 24.9.0 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
LibreNMS has Stored Cross-site Scripting vulnerability in "Alert Rules" feature
ghsa·2024-10-01
CVE-2024-47525 [MEDIUM] CWE-79 LibreNMS has Stored Cross-site Scripting vulnerability in "Alert Rules" feature
LibreNMS has Stored Cross-site Scripting vulnerability in "Alert Rules" feature
### Summary
A Stored Cross-Site Scripting (XSS) vulnerability in the "Alert Rules" feature allows authenticated users to inject arbitrary JavaScript through the "Title" field. This vulnerability can lead to the execution of malicious code in the context of other users' sessions, potentially compromising their accounts and allowing unauthorized actions.
### Details
The vulnerability occurs when creating an alert rule. The application does not properly sanitize user inputs in the "Title" field, which allows an attacker to escape the attribute context where the title is injected (data-content). Despite some character restrictions, the attacker can still inject a payload that leverages available attributes on the
OSV
LibreNMS has Stored Cross-site Scripting vulnerability in "Alert Rules" feature
osv·2024-10-01
CVE-2024-47525 [MEDIUM] LibreNMS has Stored Cross-site Scripting vulnerability in "Alert Rules" feature
LibreNMS has Stored Cross-site Scripting vulnerability in "Alert Rules" feature
### Summary
A Stored Cross-Site Scripting (XSS) vulnerability in the "Alert Rules" feature allows authenticated users to inject arbitrary JavaScript through the "Title" field. This vulnerability can lead to the execution of malicious code in the context of other users' sessions, potentially compromising their accounts and allowing unauthorized actions.
### Details
The vulnerability occurs when creating an alert rule. The application does not properly sanitize user inputs in the "Title" field, which allows an attacker to escape the attribute context where the title is injected (data-content). Despite some character restrictions, the attacker can still inject a payload that leverages available attributes on the
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-10-01
Published