CVE-2024-49754: high-severity vulnerability in librenms
LibreNMS has a stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/api-access.inc.php
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
LibreNMS allows authenticated users to inject malicious code into the API token creation page, which gets executed when other users view it. This could let attackers steal session information or perform unauthorized actions on behalf of other users.
Stored XSS vulnerability in the API-Access page (api-access.inc.php) where the 'token' parameter is not properly sanitized during token creation. An authenticated attacker can inject arbitrary JavaScript that persists in the database and executes in the browsers of other users accessing the same page, potentially leading to account compromise and unauthorized operations.
In the same product, most dangerous first.