CVE-2024-47525
Stored XSS ('Cross-site Scripting') in librenms/includes/html/print-alert-rules.php
In short
LibreNMS allows attackers to inject malicious code into alert rule titles, which then executes when other users view those rules. This can compromise user accounts and enable unauthorized actions.
Technical detail
Stored XSS vulnerability in the Alert Rules feature via the Title field, exploitable by authenticated users. The unsanitized input is stored and reflected in users' browser sessions, enabling session hijacking and privilege escalation. Fixed in version 24.9.0.
Summary generated and translated by AI from the official description.
LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the "Alert Rules" feature allows authenticated users to inject arbitrary JavaScript through the "Title" field. This vulnerability can lead to the execution of malicious code in the context of other users' sessions, potentially compromising their accounts and allowing unauthorized actions. This vulnerability is fixed in 24.9.0.
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:L
Affected products
librenms · librenmsWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →