CVE-2024-47528

CVSS V2 None CVSS V3 None
Description
LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. Stored Cross-Site Scripting (XSS) can be achieved by uploading a new Background for a Custom Map. Users with "admin" role can set background for a custom map, this allow the upload of SVG file that can contain XSS payload which will trigger on load. This led to Stored Cross-Site Scripting (XSS). The vulnerability is fixed in 24.9.0.
Overview
  • CVE ID
  • CVE-2024-47528
  • Assigner
  • GitHub_M
  • Vulnerability Status
  • PUBLISHED
  • Published Version
  • 2024-10-01T20:20:15.231Z
  • Last Modified Date
  • 2024-10-01T20:20:15.231Z
Weakness Enumerations
CWE URL
CWE-116 http://cwe.mitre.org/data/definitions/116.html
CWE-434 http://cwe.mitre.org/data/definitions/434.html
CWE-79 http://cwe.mitre.org/data/definitions/79.html
References
Reference URL Reference Tags
https://github.com/librenms/librenms/security/advisories/GHSA-x8gm-j36p-fppf x_refsource_CONFIRM
https://github.com/librenms/librenms/commit/d959bf1b366319eda16e3cd6dfda8a22beb203be x_refsource_MISC
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2024-47528
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-47528
History
Created Old Value New Value Data Type Notes
2024-10-06 21:51:46 Added to TrackCVE