CVE-2022-4067: Cross-site Scripting in librenms/librenms
Summary
CVE-2022-4067: Cross-site Scripting in librenms/librenms. Affects librenms/librenms versions < 22.10.0. Fixed in 22.10.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
LibreNMS is an open-source network monitoring tool that provides comprehensive network monitoring capabilities. It allows users to monitor various network devices, collect performance data, and generate alerts. The vulnerability identified as CVE-2022-4067 is a Cross-site Scripting (XSS) vulnerability that existed in the GitHub repository of librenms/librenms prior to version 22.10.0.
Vulnerability Detail
The Cross-site Scripting (XSS) vulnerability in librenms/librenms allowed an attacker to inject malicious scripts into web pages viewed by other users. This type of vulnerability can lead to various attacks, such as session hijacking, defacement of web pages, and theft of sensitive information. The vulnerability was rated as MODERATE severity with a CVSS score of 5.4. The CWE ID associated with this vulnerability is CWE-79.
How To Fix
Minimum fixed version
22.10.0
This is the first release that contains the fix.
composer require librenms/librenms:22.10.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, users can mitigate the risk by ensuring they are using the latest version of librenms/librenms and by implementing security best practices, such as input validation and output encoding, to prevent XSS attacks.
Conclusion
The Cross-site Scripting (XSS) vulnerability in librenms/librenms prior to version 22.10.0 poses a moderate risk to users. To mitigate this vulnerability, it is recommended to upgrade to version 22.10.0 or later. Users should also follow security best practices to prevent XSS attacks. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for librenms/librenms →
FAQ
The vulnerability allows an attacker to execute malicious scripts in the context of other users, potentially leading to unauthorized access, data theft, or defacement of web pages.
No, authentication is not required. An attacker can exploit this vulnerability by injecting malicious scripts into web pages viewed by other users.
Yes, the vulnerability has been fixed in version 22.10.0 of librenms/librenms. Users are advised to upgrade to this version or later to mitigate the risk.
There are no known instances of this vulnerability being exploited in the wild. However, it is important to apply the necessary security patches to prevent potential attacks.
For more information about this vulnerability, you can refer to the GitHub advisory database entry: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/11/GHSA-qch4-jmf8-xvp7/GHSA-qch4-jmf8-xvp7.json
References
Related vulnerabilities
Recent vulnerabilities recorded for librenms/librenms.
