Cross-site Scripting (XSS) - DOM in librenms/librenms
CVE-2023-4978

9CRITICAL

Key Information:

Vendor

Librenms

Status
Librenms/librenms
Vendor
CVE Published:
15 September 2023

What is CVE-2023-4978?

A Cross-site Scripting (XSS) vulnerability exists in LibreNMS that can be exploited to execute arbitrary JavaScript code in the user's browser. This issue arises from improper handling of user input, allowing attackers to inject malicious scripts via the Document Object Model (DOM). This vulnerability impacts all versions of LibreNMS prior to 23.9.0 and could lead to unauthorized access to sensitive information or session hijacking.

Affected Version(s)

librenms/librenms < 23.9.0

References

https://huntr.dev/bounties/cefd9295-2053-4e6e-a130-7e1f84...
https://github.com/librenms/librenms/commit/e4c46a45364cb...

CVSS V3.1

Score:
9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.