CVE-2024-50350

Summary

CVE-2024-50350 is a stored Cross-Site Scripting (XSS) vulnerability affecting LibreNMS, an open-source network monitoring system. The issue is located in the "Port Settings" page, where authenticated users can inject malicious JavaScript code through the "name" parameter when creating a new Port Group. This vulnerability is triggered when the affected Port Group is added to a device, leading to the execution of the injected code upon visiting the "Port Settings" page. The consequences include potential compromise of user sessions and unauthorized actions. The vulnerability has been addressed in version 24.10.0 of LibreNMS.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.