Self-XSS Vulnerability in LibreNMS Alert Templates
CVE-2024-47526

2.4LOW

Key Information:

Vendor

Librenms

Status
Librenms
Vendor
CVE Published:
1 October 2024

What is CVE-2024-47526?

LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Self Cross-Site Scripting (Self-XSS) vulnerability in the "Alert Templates" feature allows users to inject arbitrary JavaScript into the alert template's name. This script executes immediately upon submission but does not persist after a page refresh.

Affected Version(s)

librenms < 24.9.0

References

https://github.com/librenms/librenms/security/advisories/...
x_refsource_CONFIRM
https://github.com/librenms/librenms/commit/f259edc19b9f0...
x_refsource_MISC
https://github.com/librenms/librenms/blob/0e741e365aa974a...
x_refsource_MISC

CVSS V3.1

Score:
2.4
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.