CVE-2024-49764 Information

Description

LibreNMS is an open-source PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the \Capture Debug Information\ page allows authenticated users to inject arbitrary JavaScript through the \hostname\ parameter when creating a new device. This vulnerability results in the execution of malicious code when the \Capture Debug Information\ page is visited redirecting the user and sending non-httponly cookies to an attacker-controlled domain. This vulnerability is fixed in 24.10.0.

Reference

https://github.com/librenms/librenms/security/advisories/GHSA-rmr4-x6c9-jc68 https://github.com/librenms/librenms/commit/af15eabbb1752985d36f337cecf137a947e170f6