CVE-2022-36746: LibreNMS XSS Vulnerability
Summary
CVE-2022-36746: LibreNMS vulnerable to Cross-Site Scripting (XSS). Affects librenms/librenms versions < 22.7.0. Fixed in 22.7.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
LibreNMS is an open-source network monitoring and management system. It provides a comprehensive set of features for monitoring network devices, collecting performance data, and generating alerts. LibreNMS version 22.6.0 is susceptible to a cross-site scripting (XSS) vulnerability in the oxidized-cfg-check.inc.php component.
Vulnerability Detail
The XSS vulnerability in LibreNMS version 22.6.0 allows an attacker to inject malicious scripts into web pages viewed by other users. This can lead to various attacks, such as session hijacking, defacement of web pages, or stealing sensitive information. The vulnerability is classified as moderate severity with a CVSS score of 6.1. The CWE ID associated with this vulnerability is CWE-79.
How To Fix
Minimum fixed version
22.7.0
This is the first release that contains the fix.
composer require librenms/librenms:22.7.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the official patch or upgrade to a fixed version of LibreNMS.
Conclusion
LibreNMS version 22.6.0 is vulnerable to a cross-site scripting (XSS) attack. Users should upgrade to a fixed version or apply the provided patch to mitigate the risk. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for librenms/librenms →
FAQ
LibreNMS is an open-source network monitoring and management system.
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users.
This vulnerability can lead to various attacks, such as session hijacking, defacement of web pages, or stealing sensitive information.
This vulnerability is classified as moderate severity with a CVSS score of 6.1.
To fix this vulnerability, it is recommended to upgrade to a version of LibreNMS that is higher than 22.6.0.
References
Related vulnerabilities
Recent vulnerabilities recorded for librenms/librenms.
