CVE-2024-32479

Опубликовано: 22 апр. 2024

Источник: nvd

CVSS3: 7.1

CVSS3: 5.4

EPSS Низкий

Описание

LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. Prior to version 24.4.0, there is improper sanitization on the Service template name, which can lead to stored Cross-site Scripting. Version 24.4.0 fixes this vulnerability.

Ссылки

https://github.com/librenms/librenms/blob/a61c11db7e8ef6a437ab55741658be2be7d14d34/app/Http/Controllers/ServiceTemplateController.php#L67C23-L67C23
Product
https://github.com/librenms/librenms/commit/19344f0584d4d6d4526fdf331adc60530e3f685b
Patch
https://github.com/librenms/librenms/security/advisories/GHSA-72m9-7c8x-pmmw
Exploit
Vendor Advisory
https://github.com/librenms/librenms/blob/a61c11db7e8ef6a437ab55741658be2be7d14d34/app/Http/Controllers/ServiceTemplateController.php#L67C23-L67C23
Product
https://github.com/librenms/librenms/commit/19344f0584d4d6d4526fdf331adc60530e3f685b
Patch
https://github.com/librenms/librenms/security/advisories/GHSA-72m9-7c8x-pmmw
Exploit
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:librenms:librenms:*:*:*:*:*:*:*:*

Версия до 24.4.0 (исключая)

EPSS

Процентиль: 71%

0.00681

Низкий

7.1 High

CVSS3

5.4 Medium

CVSS3

Дефекты

CWE-79

Связанные уязвимости

GHSA-72m9-7c8x-pmmw

CVSS3: 7.1

github

почти 2 года назад

LibreNMS uses Improper Sanitization on Service template name leads to Stored XSS

EPSS

Процентиль: 71%

0.00681

Низкий

7.1 High

CVSS3

5.4 Medium

CVSS3

Дефекты

CWE-79