Vulnerability details
CVE-2024-49754
librenms librenms
LibreNMS has a stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/api-access.inc.php
CVSS 3.1
7.5High
Official description
LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the API-Access page allows authenticated users to inject arbitrary JavaScript through the "token" parameter when creating a new API token. This vulnerability can result in the execution of malicious code in the context of other users' sessions, compromising their accounts and enabling unauthorized actions. This vulnerability is fixed in 24.10.0.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 7.5High | 3.1 | CVEProject cvelistV5 (CNA) (GitHub_M) | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:L |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| librenms | librenms | v < 24.10.0 | CISA ADP / Vulnrichment |
| librenms | librenms | < 24.10.0 | CVEProject cvelistV5 (CNA) |
References and advisories
2
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2024-11-15
- Last updated
- 2024-11-15
- State
- Published
- Assigner (CNA)
- GitHub_M
Exploit prediction (EPSS)
73.9%
Probability of exploitation in 30 days
99.4%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- Proof of concept
- Technical impact
- Partial
Weaknesses (CWE)
- CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')