Medium severity · published Nov 15, 2024
CVE-2024-51494
LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system
5.4
CVSS
0.4%
EPSS
No
On KEV
Description
LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the "Port Settings" page allows authenticated users to inject arbitrary JavaScript through the "descr" parameter when editing a device's port settings. This vulnerability can lead to the execution of malicious code when the "Port Settings" page is visited, potentially compromising the user's session and allowing unauthorized actions. This vulnerability is fixed in 24.10.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 37% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LI
Librenms · Librenms
before 24.10.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-51494
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-51494
Patch
https://github.com/librenms/librenms/commit/82a744bfe29017b8b58b5752ab9e1b335bedf0a0
Exploit
https://github.com/librenms/librenms/security/advisories/GHSA-7663-37rg-c377
More from Librenms
9.8
CVE-2026-86426
LibreNMS before 26.8.0 Authentication Bypass via API Token Type Confusion
9.8
CVE-2022-4070
Insufficient Session Expiration in GitHub repository librenms/librenms prior to 22.10.0
9.8
CVE-2022-29712
LibreNMS v22.3.0 was discovered to contain multiple command injection vulnerabilities via the service_ip, hostname, and service_param parameters
9.8
CVE-2021-44278
Librenms 21.11.0 is affected by a path manipulation vulnerability in includes/html/pages/device/showconfig.inc.php
9.8
CVE-2019-10665
An issue was discovered in LibreNMS through 1.47