VulnerabilityAnalyzed

CVE-2024-49754

A Stored Cross-Site Scripting (XSS) vulnerability in the API-Access page allows authenticated users to inject arbitrary JavaScript through the "token" parameter when creating a new API token.

MEDIUM 5.4EPSS 71.1%

Does this matter?

EPSS puts the probability of exploitation in the next 30 days at 71.1%, higher than 99% of all known CVEs. Patch or mitigate before the next change window.

Description

LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the API-Access page allows authenticated users to inject arbitrary JavaScript through the "token" parameter when creating a new API token. This vulnerability can result in the execution of malicious code in the context of other users' sessions, compromising their accounts and enabling unauthorized actions. This vulnerability is fixed in 24.10.0.

CVSS 3.1: 5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
EPSS: 71.08% probability · 99th percentile
CISA KEV: Not listed
Weakness: CWE-79
Affected: librenms/librenms
Source: security-advisories@github.com

References

https://github.com/librenms/librenms/commit/25988a937cbaebd2ba4c0517510206c404dfb359Patch
https://github.com/librenms/librenms/security/advisories/GHSA-gfwr-xqmj-j27vExploit, Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.