PT-2024-34161 · Librenms · Librenms

Raphaelcss + 1 · Published 2024-11-15 · Updated 2024-11-20 · CVE-2024-50352

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions: LibreNMS versions prior to 24.10.0

Description: A Stored Cross-Site Scripting (XSS) vulnerability in the "Services" section of the Device Overview page allows authenticated users to inject arbitrary JavaScript through the name parameter when adding a service to a device. This could result in the execution of malicious code in the context of other users' sessions, potentially compromising their accounts and enabling unauthorized actions.

Recommendations: For versions prior to 24.10.0, update to version 24.10.0 to fix the vulnerability. As a temporary workaround, consider restricting access to the "Services" section of the Device Overview page to minimize the risk of exploitation. Avoid using the name parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-50352

GHSA-QR8F-5QQG-J3WG

Affected Products

Librenms

References · 10

• 🔥 https://github.com/librenms/librenms/security/advisories/GHSA-qr8f-5qqg-j3wg · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/50xxx/CVE-2024-50352.json · Exploit
• https://github.com/librenms/librenms/commit/b4af778ca42c5839801f16ece53505bb7fa1e7bc · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-50352 · Security Note
• https://osv.dev/vulnerability/GHSA-qr8f-5qqg-j3wg · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-50352 · Vendor Advisory
• https://github.com/librenms/librenms · Note
• https://twitter.com/CVEnew/status/1857451364340875375 · Twitter Post
• https://t.me/cvenotify/102283 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1857507318881017873 · Twitter Post