CVE-2023-5060: Cross-Site Scripting in librenms/librenms
Summary
CVE-2023-5060: Cross site scripting in librenms. Affects librenms/librenms versions < 23.9.1. Fixed in 23.9.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
librenms/librenms is an open-source network monitoring tool written in PHP. It provides a web-based interface for monitoring and graphing network devices and servers. The vulnerability identified as CVE-2023-5060 is a Cross-Site Scripting (XSS) vulnerability in the librenms/librenms GitHub repository prior to version 23.9.1.
Vulnerability Detail
The Cross-Site Scripting (XSS) vulnerability in librenms/librenms allows an attacker to inject malicious scripts into web pages viewed by users. This can lead to various security risks, such as unauthorized access to sensitive information, session hijacking, or the execution of arbitrary code on the victim's browser. The vulnerability originates from improper input sanitization, allowing the attacker to inject malicious code that is executed within the victim's browser.
How To Fix
Minimum fixed version
23.9.1
This is the first release that contains the fix.
composer require librenms/librenms:23.9.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version to mitigate the risk of exploitation.
Conclusion
The Cross-Site Scripting (XSS) vulnerability in librenms/librenms prior to version 23.9.1 poses a significant security risk. It is crucial for users to upgrade to the fixed version to protect their systems and data. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for librenms/librenms →
FAQ
librenms/librenms is an open-source network monitoring tool written in PHP. It provides a web-based interface for monitoring and graphing network devices and servers.
Cross-Site Scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by users. This can lead to various security risks, such as unauthorized access to sensitive information or the execution of arbitrary code on the victim's browser.
The impact of this vulnerability includes the potential for unauthorized access to sensitive information, session hijacking, or the execution of arbitrary code on the victim's browser.
To fix this vulnerability, it is recommended to upgrade to version 23.9.1 or later of librenms/librenms. This version includes proper input sanitization to prevent XSS attacks.
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version to mitigate the risk of exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for librenms/librenms.
