PT-2019-14027 · Librenms · Librenms

Publicado 2019-08-28 · Atualizado 2019-08-30 · CVE-2019-15230

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions LibreNMS version 1.54

Description The issue affects several sections of the admin console, including Create User, Inventory, Add Device, Notifications, Alert Rule, Create Maintenance, and Alert Template. It allows for XSS attacks, which could result in cookie stealing and other malicious actions. This can be exploited with an authenticated account.

Recommendations For LibreNMS version 1.54, consider restricting access to the admin console sections until a fix is available, and avoid using the affected sections with an authenticated account to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2019-15230

Produtos afetados

Librenms

Referências · 3

• 🔥 https://sevenlayers.com/index.php/239-librenms-v1-54-xss · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-15230 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-15230 · Aviso do Fabricante