PT-2024-34659 · Librenms · Librenms

Raphaelcss + 1 · Published 2024-11-15 · Updated 2024-11-20 · CVE-2024-51495

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions LibreNMS versions prior to 24.10.0

Description A Stored Cross-Site Scripting (XSS) vulnerability in the Device Overview page allows authenticated users to inject arbitrary JavaScript through the overwrite ip parameter when editing a device. This results in the execution of malicious code when the device overview page is visited, potentially compromising the accounts of other users. The vulnerability occurs when editing a device, and an attacker can inject arbitrary JavaScript into the overwrite ip parameter. The malicious script is then executed in the "Assigned IP" field when the device overview page is loaded.

Recommendations For versions prior to 24.10.0, update to version 24.10.0 or later to fix the vulnerability. As a temporary workaround, consider restricting access to the Device Overview page or disabling the editing of devices to minimize the risk of exploitation. Avoid using the overwrite ip parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-51495

GHSA-P66Q-PPWR-Q5J8

Affected Products

Librenms

References · 10

• 🔥 https://github.com/librenms/librenms/security/advisories/GHSA-p66q-ppwr-q5j8 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/51xxx/CVE-2024-51495.json · Exploit
• https://github.com/librenms/librenms/commit/4568188ce9097a2e3a3b563311077f2bb82455c0 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-51495 · Security Note
• https://osv.dev/vulnerability/GHSA-p66q-ppwr-q5j8 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-51495 · Vendor Advisory
• https://github.com/librenms/librenms · Note
• https://t.me/cvedetector/11096 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1857532918937096303 · Twitter Post
• https://twitter.com/CVEnew/status/1857458729978916889 · Twitter Post