CVE-2023-4981: LibreNMS Cross-site Scripting vulnerability
Summary
CVE-2023-4981: LibreNMS Cross-site Scripting vulnerability. Affects librenms/librenms versions < 23.9.0. Fixed in 23.9.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
LibreNMS is an open-source network monitoring and management tool. It provides a comprehensive set of features for monitoring network devices, collecting performance data, and generating alerts. The vulnerability identified in this report is a Cross-site Scripting (XSS) vulnerability in the GitHub repository of LibreNMS prior to version 23.9.0. This vulnerability allows an attacker to inject malicious scripts into web pages viewed by users, potentially leading to unauthorized access, data theft, or other malicious activities.
Vulnerability Detail
The Cross-site Scripting (XSS) vulnerability in LibreNMS arises from a failure to properly sanitize user-supplied input. This allows an attacker to inject arbitrary JavaScript code into web pages viewed by users. When a vulnerable page is loaded, the injected code is executed in the context of the victim's browser, potentially leading to the theft of sensitive information, session hijacking, or other malicious actions. The impact of this vulnerability is rated as HIGH with a CVSS score of 8.8.
How To Fix
Minimum fixed version
23.9.0
This is the first release that contains the fix.
composer require librenms/librenms:23.9.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately possible, a temporary workaround is to disable user-generated content or implement input validation and sanitization measures to prevent the execution of malicious scripts. This can be achieved by implementing strict input filtering and encoding techniques to neutralize any potential script injection attempts.
Conclusion
The Cross-site Scripting (XSS) vulnerability in LibreNMS prior to version 23.9.0 poses a significant security risk, allowing attackers to inject malicious scripts into web pages viewed by users. To mitigate this vulnerability, it is crucial to upgrade to the latest version of LibreNMS (23.9.0 or later) or implement appropriate input validation and sanitization measures. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for librenms/librenms →
FAQ
LibreNMS is an open-source network monitoring and management tool that provides a comprehensive set of features for monitoring network devices, collecting performance data, and generating alerts.
Cross-site Scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by users. This can lead to unauthorized access, data theft, or other malicious activities.
The impact of this vulnerability is rated as HIGH with a CVSS score of 8.8. It allows an attacker to inject arbitrary JavaScript code into web pages, potentially leading to the theft of sensitive information, session hijacking, or other malicious actions.
To fix this vulnerability, it is recommended to upgrade to LibreNMS version 23.9.0 or later. This version includes the necessary fixes to properly sanitize user input and prevent the execution of injected scripts.
If upgrading to the latest version is not immediately possible, a temporary workaround is to disable user-generated content or implement input validation and sanitization measures to prevent the execution of malicious scripts.
Related vulnerabilities
Recent vulnerabilities recorded for librenms/librenms.
