PT-2025-42520 · Librenms · Librenms

Publicado 2025-10-16 · Atualizado 2025-10-16 · CVE-2025-62412

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Média

Vetor base

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions LibreNMS versions 25.8.0 through 25.10.0

Description LibreNMS contains a flaw in the Alerts > Alert Rules page where the alert rule name is not properly sanitized. This allows for the injection of HTML code, potentially leading to Cross-Site Scripting (XSS). The vulnerability exists due to insufficient sanitization of the name parameter when creating or updating alert rules via a POST request to the /ajax form.php endpoint. The sanitization attempt using strip tags() can be bypassed using XML character references, such as <script>alert(1)</script>. The injected script is then executed when the bootgrid() function decodes these references during table rendering.

Recommendations LibreNMS version 25.10.0 resolves this issue. LibreNMS versions 25.8.0 and 25.9.0 are affected and should be updated.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2025-62412

GHSA-6G2V-66CH-6XMH

Produtos afetados

Librenms

Referências · 10

• 🔥 https://github.com/librenms/librenms/security/advisories/GHSA-6g2v-66ch-6xmh · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62412.json · Exploit
• https://github.com/librenms/librenms · Nota
• https://github.com/librenms/librenms/commit/dccdf6769976a974d70f06a7ce8d5a846b29db6f · Correção
• https://github.com/librenms/librenms/releases/tag/25.10.0 · Nota
• https://twitter.com/CVEnew/status/1978926566324220207 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2025-62412 · Aviso do Fabricante
• https://t.me/CVEtracker/35134 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2025-62412 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-6g2v-66ch-6xmh · Aviso do Fabricante