Vulnerability Description
LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the Device Overview page allows authenticated users to inject arbitrary JavaScript through the "overwrite_ip" parameter when editing a device. This vulnerability results in the execution of malicious code when the device overview page is visited, potentially compromising the accounts of other users. This vulnerability is fixed in 24.10.0.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Librenms | Librenms | < 24.10.0 |
Related Weaknesses (CWE)
References
- https://github.com/librenms/librenms/commit/4568188ce9097a2e3a3b563311077f2bb824Patch
- https://github.com/librenms/librenms/security/advisories/GHSA-p66q-ppwr-q5j8ExploitVendor Advisory
FAQ
What is CVE-2024-51495?
CVE-2024-51495 is a vulnerability with a CVSS score of 4.8 (MEDIUM). LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the Device Overview page allows authenticated users to inject arbitrary...
How severe is CVE-2024-51495?
CVE-2024-51495 has been rated MEDIUM with a CVSS base score of 4.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2024-51495?
Check the references section above for vendor advisories and patch information. Affected products include: Librenms Librenms.