PT-2019-14027 · Librenms · Librenms

Published 2019-08-28 · Updated 2019-08-30 · CVE-2019-15230

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions LibreNMS version 1.54

Description The issue affects several sections of the admin console, including Create User, Inventory, Add Device, Notifications, Alert Rule, Create Maintenance, and Alert Template. It allows for XSS attacks, which could result in cookie stealing and other malicious actions. This can be exploited with an authenticated account.

Recommendations For LibreNMS version 1.54, consider restricting access to the admin console sections until a fix is available, and avoid using the affected sections with an authenticated account to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-15230

Affected Products

Librenms

References · 3

• 🔥 https://sevenlayers.com/index.php/239-librenms-v1-54-xss · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-15230 · Security Note
• https://osv.dev/vulnerability/CVE-2019-15230 · Vendor Advisory