CVE-2024-49754

high · 7.5

LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the API-Access page allows authenticated users to inject arbitrary JavaScript through the "token" parameter when creating a new API token. This vulnerability can result in the execution of malicious code in the context of other users' sessions, compromising their accounts and enabling unauthorized actions. This vulnerability is fixed in 24.10.0.

7.5

CVSS

71.1%

EPSS (exploit prob.)

99th

EPSS percentile

2024-11-15

Published

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:L

Weaknesses

CWE-79

Affected products

Vendor	Product	Affected versions
librenms	librenms	< 24.10.0

Check a specific version with /api/v1/cve/match.

References

https://github.com/librenms/librenms/commit/25988a937cbaebd2ba4c0517510206c404dfb359
https://github.com/librenms/librenms/security/advisories/GHSA-gfwr-xqmj-j27v

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2024-49754