CVE-2024-32479: high-severity vulnerability in librenms
LibreNMS's Improper Sanitization on Service template name leads to Stored XSS
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
LibreNMS, a network monitoring system, fails to properly clean user input in Service template names, allowing attackers to inject malicious code that gets stored and executed in users' browsers when they view the template.
A stored XSS vulnerability exists in LibreNMS versions prior to 24.4.0 due to insufficient input sanitization on the Service template name parameter. An authenticated attacker can inject malicious JavaScript that persists in the database and executes in the context of other users' browsers, potentially leading to session hijacking or credential theft.
In the same product, most dangerous first.