PT-2024-33669 · Librenms · Librenms

Raphaelcss + 1 · Published 2024-11-15 · Updated 2024-11-20 · CVE-2024-49759

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: LibreNMS versions prior to 24.10.0

Description: A Stored Cross-Site Scripting (XSS) vulnerability in the "Manage User Access" page allows authenticated users to inject arbitrary JavaScript through the bill name parameter when creating a new bill. This can lead to the execution of malicious code when visiting the "Bill Access" dropdown in the user's "Manage Access" page, potentially compromising user sessions and allowing unauthorized actions.

Recommendations: For versions prior to 24.10.0, update to version 24.10.0 to fix the vulnerability. As a temporary workaround, consider restricting access to the "Manage User Access" page and the "Bill Access" dropdown to minimize the risk of exploitation. Avoid using the bill name parameter in the affected page until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-49759

GHSA-888J-PJQH-FX58

Affected Products

Librenms

References · 11

• 🔥 https://github.com/librenms/librenms/security/advisories/GHSA-888j-pjqh-fx58 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/49xxx/CVE-2024-49759.json · Exploit
• https://github.com/librenms/librenms/commit/237f4d2e818170171dfad6efad36a275cd2ba8d0 · Patch
• https://osv.dev/vulnerability/CVE-2024-49759 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-49759 · Security Note
• https://osv.dev/vulnerability/GHSA-888j-pjqh-fx58 · Vendor Advisory
• https://github.com/librenms/librenms · Note
• https://twitter.com/CVEnew/status/1857448660700717229 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1857543158801838254 · Twitter Post
• https://t.me/cvedetector/11107 · Telegram Post
• https://t.me/cvenotify/102280 · Telegram Post