CVE-2024-47525CWE-79

Stored XSS ('Cross-site Scripting') in librenms/includes/html/print-alert-rules.php

High · published October 1, 2024

CVSS v3.1

7.5

EPSS

30%

Percentile

98.2

In the wild

Unconfirmed

What it is

LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the "Alert Rules" feature allows authenticated users to inject arbitrary JavaScript through the "Title" field. This vulnerability can lead to the execution of malicious code in the context of other users' sessions, potentially compromising their accounts and allowing unauthorized actions. This vulnerability is fixed in 24.9.0.

The record

Technical detail

CVSS v3.1: 7.5 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:L
CVSS v4.0: Not supplied
EPSS: 0.29648 · 98.2th percentile
Weakness: CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published: 2024-10-01T20:27Z

EPSS history

Timeline

01 OCT 20:27Z
Stored XSS ('Cross-site Scripting') in librenms/includes/html/print-alert-rules.php
cvelistv5