GitHub Advisoryadvisory · Packagist

GHSA-6c5q-fg3g-qhhv LibreNMS stored cross-site scripting (XSS) vulnerability in the Device Settings section

MEDIUM Published 2024-12-06 Modified 2024-12-10 Official page ↗
Aliases
CVE-2024-53457
Ecosystem
Packagist
Packages
librenms/librenms
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2024-12-10

Affected packages

• Packagist librenms/librenms: >= 24.9.0, < 24.11.0 → fixed in 24.11.0

Description

A stored cross-site scripting (XSS) vulnerability in the Device Settings section of LibreNMS v24.9.0 to v24.10.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Display Name parameter.

Related

Alias · CVE (1)

  • CVE-2024-53457 A stored cross-site scripting (XSS) vulnerability in the Device Settings section of LibreNMS v24.9.0 to v24.10.0 allows attackers to… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References