CVE-2024-49754CWE-79

LibreNMS has a stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/api-access.inc.php

High · published November 15, 2024

Patch now

High probability of exploitation

CVSS calls it high at 7.5. It sits in the 99.4th percentile for exploit probability.

CVSS v3.1

7.5

EPSS

72%

Percentile

99.4

In the wild

Unconfirmed

What it is

LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the API-Access page allows authenticated users to inject arbitrary JavaScript through the "token" parameter when creating a new API token. This vulnerability can result in the execution of malicious code in the context of other users' sessions, compromising their accounts and enabling unauthorized actions. This vulnerability is fixed in 24.10.0.

The record

Technical detail

CVSS v3.1: 7.5 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:L
CVSS v4.0: Not supplied
EPSS: 0.72377 · 99.4th percentile
Weakness: CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published: 2024-11-15T15:11Z

EPSS history

Timeline

15 NOV 15:11Z
LibreNMS has a stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/api-access.inc.php
cvelistv5