PT-2024-33665 · Librenms · Librenms

Raphaelcss + 1 · Published 2024-11-15 · Updated 2024-11-20 · CVE-2024-49754

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions: LibreNMS versions prior to 24.10.0

Description: A Stored Cross-Site Scripting (XSS) vulnerability in the API-Access page allows authenticated users to inject arbitrary JavaScript through the token parameter when creating a new API token. This can result in the execution of malicious code in the context of other users' sessions, compromising their accounts and enabling unauthorized actions.

Recommendations: For versions prior to 24.10.0, update to version 24.10.0 to fix the vulnerability. As a temporary workaround, consider restricting access to the API-Access page or disabling the creation of new API tokens until the update is applied. Avoid using the token parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-49754

GHSA-GFWR-XQMJ-J27V

Affected Products

Librenms

References · 10

• 🔥 https://github.com/librenms/librenms/security/advisories/GHSA-gfwr-xqmj-j27v · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/49xxx/CVE-2024-49754.json · Exploit
• https://github.com/librenms/librenms/commit/25988a937cbaebd2ba4c0517510206c404dfb359 · Patch
• https://osv.dev/vulnerability/GHSA-gfwr-xqmj-j27v · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-49754 · Security Note
• https://osv.dev/vulnerability/CVE-2024-49754 · Vendor Advisory
• https://github.com/librenms/librenms · Note
• https://twitter.com/CVEnew/status/1857448672503472292 · Twitter Post
• https://t.me/cvenotify/102278 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1857540598795776427 · Twitter Post