CVE-2024-56144CWE-79

Stored XSS-LibreNMS-Display Name 2 in librenms

Medium · published January 16, 2025

CVSS v3.1
4.6
EPSS
0%
Percentile
31.4
In the wild
Unconfirmed
What it is

librenms is a community-based GPL-licensed network monitoring system. Affected versions are subject to a stored XSS on the parameters (Replace $DEVICE_ID with your specific $DEVICE_ID value):`/device/$DEVICE_ID/edit` -> param: display. Librenms versions up to 24.11.0 allow remote attackers to inject malicious scripts. When a user views or interacts with the page displaying the data, the malicious script executes immediately, leading to potential unauthorized actions or data exposure. This issue has been addressed in release version 24.12.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.

The record
Technical detail
CVSS v3.1
4.6 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00386 · 31.4th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-01-16T22:28Z
EPSS history
Timeline
  • 16 JAN 22:28Z
    Stored XSS-LibreNMS-Display Name 2 in librenms
    cvelistv5