PT-2024-34164 · Librenms · Librenms

Minhnq1618 · Published 2024-11-15 · Updated 2024-11-20 · CVE-2024-50355

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: LibreNMS versions prior to 24.10.0

Description: The application fails to properly sanitize user input in the device Display Name, allowing an attacker to execute malicious JavaScript code. This can be triggered from different sources, including the Manage Access page, Alert Rules, Alerts Notifications, Alert History, Event Log, Outages function, and the dashboard. The impact of this issue could allow authenticated users to execute arbitrary JavaScript code in the context of other users' sessions, potentially compromising user accounts and enabling unauthorized actions.

Recommendations: For versions prior to 24.10.0, update to version 24.10.0 or later to fix the vulnerability. As a temporary workaround, consider restricting access to the device Display Name field for users with Admin roles until the update is applied. Additionally, avoid using JavaScript code in the device Display Name to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-50355

GHSA-4M5R-W2RQ-Q54Q

Affected Products

Librenms

References · 10

• 🔥 https://github.com/librenms/librenms/security/advisories/GHSA-4m5r-w2rq-q54q · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/50xxx/CVE-2024-50355.json · Exploit
• https://github.com/librenms/librenms/commit/bb4731419b592867bf974dde525e536606a52976 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-50355 · Security Note
• https://osv.dev/vulnerability/CVE-2024-50355 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4m5r-w2rq-q54q · Vendor Advisory
• https://github.com/librenms/librenms · Note
• https://twitter.com/CVEnew/status/1857451362075955352 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1857509878887026704 · Twitter Post
• https://t.me/cvedetector/11105 · Telegram Post