CVE-2024-49764
CVSS 3.1 Score 4.8 of 10 (medium)
Details
Published Nov 15, 2024
CWE ID 79
Summary
CVE-2024-49764 is a stored Cross-Site Scripting (XSS) vulnerability affecting the open-source network monitoring system, LibreNMS. Authenticated users can exploit this issue by injecting malicious JavaScript code into the "hostname" parameter when creating a new device on the "Capture Debug Information" page. Upon visiting this page, the injected code is executed, potentially redirecting the user to an attacker-controlled domain and sending non-httponly cookies. This vulnerability has been addressed in version 24.10.0 of LibreNMS.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Affected Products
- LibreNMS
Affected Vendors
- LibreNMS