CVE-2024-47524
High
Description
LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. User with Admin role can create a Device Groups, the application did not properly sanitize the user input in the Device Groups name, when user see the detail of the Device Group, if java script code is inside the name of the Device Groups, its will be trigger. This vulnerability is fixed in 24.9.0.
SeverityHigh
CVSS7.2
Exploit probability—
ProductLibrenms
PublishedOct 1, 2024
First seenOct 1, 2024
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Update
- librenms librenms24.9.0 or later
- librenms/librenms24.9.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| librenms librenms | v < 24.9.0 | 24.9.0 |
| librenms/librenmsPackagist | v < 24.9.0 | 24.9.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.