CVE-2022-4068: Cross-site Scripting in librenms/librenms
Summary
CVE-2022-4068: Cross-site Scripting in librenms/librenms. Affects librenms/librenms versions < 22.10.0. Fixed in 22.10.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
LibreNMS is an open-source network monitoring tool that provides comprehensive network monitoring and alerting capabilities. It is widely used by network administrators to monitor the health and performance of their network infrastructure. However, a vulnerability has been discovered in the librenms/librenms package that allows an attacker to execute arbitrary JavaScript in the context of an admin's account.
Vulnerability Detail
The vulnerability arises from the improper sanitization of the username in the admin user overview. This allows an attacker with a low privilege user account to inject malicious JavaScript code, which will be executed when an admin views the user overview page. Additionally, the vulnerability allows a user to enable their own account even if it was disabled by an admin, as long as the user holds a valid session. This can lead to unauthorized access and potential privilege escalation.
How To Fix
Minimum fixed version
22.10.0
This is the first release that contains the fix.
composer require librenms/librenms:22.10.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to upgrade to the latest version of the librenms/librenms package to mitigate the risk.
Conclusion
The vulnerability in the librenms/librenms package allows for cross-site scripting attacks and unauthorized account enablement. It is crucial to upgrade to version 22.10.0 or later to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for librenms/librenms →
FAQ
This vulnerability allows an attacker to execute arbitrary JavaScript in the context of an admin's account, potentially leading to unauthorized access and privilege escalation.
Users of the librenms/librenms package prior to version 22.10.0 are affected by this vulnerability.
There are no known public exploits for this vulnerability at the time of this advisory.
The only effective mitigation is to upgrade to version 22.10.0 or later of the librenms/librenms package.
After upgrading, it is recommended to review the user accounts and ensure that no unauthorized changes have been made.
Related vulnerabilities
Recent vulnerabilities recorded for librenms/librenms.
