Vulnerability Description
LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the "Services" section of the Device Overview page allows authenticated users to inject arbitrary JavaScript through the "name" parameter when adding a service to a device. This vulnerability could result in the execution of malicious code in the context of other users' sessions, potentially compromising their accounts and enabling unauthorized actions. This vulnerability is fixed in 24.10.0.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Librenms | Librenms | < 24.10.0 |
Related Weaknesses (CWE)
References
- https://github.com/librenms/librenms/commit/b4af778ca42c5839801f16ece53505bb7fa1Patch
- https://github.com/librenms/librenms/security/advisories/GHSA-qr8f-5qqg-j3wgExploitVendor Advisory
FAQ
What is CVE-2024-50352?
CVE-2024-50352 is a vulnerability with a CVSS score of 4.8 (MEDIUM). LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the "Services" section of the Device Overview page allows authenticated...
How severe is CVE-2024-50352?
CVE-2024-50352 has been rated MEDIUM with a CVSS base score of 4.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2024-50352?
Check the references section above for vendor advisories and patch information. Affected products include: Librenms Librenms.