PT-2024-34661 · Librenms · Librenms

Raphaelcss + 1 · Published 2024-11-15 · Updated 2026-02-18 · CVE-2024-51497

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions LibreNMS versions prior to 24.10.0

Description A Stored Cross-Site Scripting (XSS) vulnerability in the "Custom OID" tab of a device allows authenticated users to inject arbitrary JavaScript through the unit parameter when creating a new OID. This can lead to the execution of malicious code in the context of other users' sessions, compromising their accounts and enabling unauthorized actions.

Recommendations For versions prior to 24.10.0, update to version 24.10.0 to fix the vulnerability. As a temporary workaround, consider restricting access to the "Custom OID" tab or disabling the ability to create new OIDs until the update can be applied. Avoid using the unit parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-51497

GHSA-GV4M-F6FX-859X

Affected Products

Librenms

References · 11

• 🔥 https://github.com/librenms/librenms/security/advisories/GHSA-gv4m-f6fx-859x · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/51xxx/CVE-2024-51497.json · Exploit
• https://github.com/librenms/librenms/commit/42b156e42a3811c23758772ce8c63d4d3eaba59b · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-51497 · Security Note
• https://osv.dev/vulnerability/CVE-2024-51497 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gv4m-f6fx-859x · Vendor Advisory
• https://github.com/librenms/librenms · Note
• https://twitter.com/VulmonFeeds/status/1857535478926324174 · Twitter Post
• https://t.me/cvedetector/11098 · Telegram Post
• https://twitter.com/dailycve/status/2024254877350666282 · Twitter Post
• https://twitter.com/CVEnew/status/1857458727093215438 · Twitter Post