Vulnerability Description
LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the "Custom OID" tab of a device allows authenticated users to inject arbitrary JavaScript through the "unit" parameter when creating a new OID. This vulnerability can lead to the execution of malicious code in the context of other users' sessions, compromising their accounts and enabling unauthorized actions. This vulnerability is fixed in 24.10.0.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Librenms | Librenms | < 24.10.0 |
Related Weaknesses (CWE)
References
- https://github.com/librenms/librenms/commit/42b156e42a3811c23758772ce8c63d4d3eabPatch
- https://github.com/librenms/librenms/security/advisories/GHSA-gv4m-f6fx-859xExploitVendor Advisory
FAQ
What is CVE-2024-51497?
CVE-2024-51497 is a vulnerability with a CVSS score of 4.8 (MEDIUM). LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the "Custom OID" tab of a device allows authenticated users to inject a...
How severe is CVE-2024-51497?
CVE-2024-51497 has been rated MEDIUM with a CVSS base score of 4.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2024-51497?
Check the references section above for vendor advisories and patch information. Affected products include: Librenms Librenms.