We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Crisp.chat (Helpdesk and Chat)

Ok

THREATINT
PUBLISHED

CVE-2024-51497

LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/print-customoid.php



Description

LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the "Custom OID" tab of a device allows authenticated users to inject arbitrary JavaScript through the "unit" parameter when creating a new OID. This vulnerability can lead to the execution of malicious code in the context of other users' sessions, compromising their accounts and enabling unauthorized actions. This vulnerability is fixed in 24.10.0.

Reserved 2024-10-28 | Published 2024-11-15 | Updated 2024-11-15 | Assigner GitHub_M


MEDIUM: 4.8CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Product status

< 24.10.0
affected

References

github.com/librenms/librenms/security/advisories/GHSA-gv4m-f6fx-859x

github.com/librenms/librenms/commit/42b156e42a3811c23758772ce8c63d4d3eaba59b

cve.org (CVE-2024-51497)

nvd.nist.gov (CVE-2024-51497)

Download JSON

Share this page
https://cve.threatint.com/CVE/CVE-2024-51497

Support options

Helpdesk Chat, Email, Knowledgebase
Telegram Chat
Subscribe to our newsletter to learn more about our work.