CVE-2023-48295CWE-79

Cross-site Scripting at Device groups Deletion feature in LibreNMS

Medium · published November 17, 2023

CVSS v3.1
6.3
EPSS
1%
Percentile
46.0
In the wild
Unconfirmed
What it is

LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring which includes support for a wide range of network hardware and operating systems. Affected versions are subject to a cross site scripting (XSS) vulnerability in the device group popups. This issue has been addressed in commit `faf66035ea` which has been included in release version 23.11.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00562 · 46.0th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2023-11-17T21:06Z
EPSS history
Timeline
  • 17 NOV 21:06Z
    Cross-site Scripting at Device groups Deletion feature in LibreNMS
    cvelistv5