CVE-2024-49759
CVSS 3.1 Score 4.8 of 10 (medium)
Details
Published Nov 15, 2024
CWE ID 79
Summary
CVE-2024-49759 is a stored Cross-Site Scripting (XSS) vulnerability affecting LibreNMS, an open-source network monitoring system. Authenticated users can exploit this flaw by injecting malicious JavaScript code into the "bill_name" parameter when creating a new bill. An attacker can then execute this code by visiting the "Bill Access" dropdown on the user's "Manage Access" page. This vulnerability poses a serious risk, as it can compromise user sessions and enable unauthorized actions. The issue is resolved in version 24.10.0.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Affected Products
- LibreNMS
Affected Vendors
- LibreNMS