Stored XSS Flaw in LibreNMS Network Monitoring Solution

CVE-2024-49764

What is CVE-2024-49764?

A Stored Cross-Site Scripting (XSS) vulnerability exists in LibreNMS, an open-source network monitoring system. Authenticated users can exploit the flaw on the 'Capture Debug Information' page by injecting arbitrary JavaScript via the 'hostname' parameter when adding a new device. This malicious code execution occurs when the vulnerable page is accessed, potentially redirecting users and sending non-httponly cookies to an attacker-controlled domain. Users are strongly advised to update to version 24.10.0 or later to mitigate this issue.

References