7.1 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
6.9 Medium
AI Score
Confidence
High
0.0004 Low
EPSS
Percentile
15.8%
There is improper sanitization on Service template name which is reflecting in delete button onclick event. This value can be modified and crafted as any other javascript code.
Above is vulnerable code line which needs to be properly sanitized
testing', '14', 'http://172.105.62.194:8000/services/templates/14');alert(1);//
If you inspect element on delete button, you will notice this:-
<img width=“748” alt=“Screenshot 2023-11-23 at 9 30 24 PM” src=“https://user-images.githubusercontent.com/31764504/285260018-7672a93d-e29b-4444-8057-e6ffcb8dabfc.png”>
Cross site scripting can lead to cookie stealing or an attacker can execute any other feature using this feature.
CPE | Name | Operator | Version |
---|---|---|---|
librenms/librenms | lt | 24.4.0 |
github.com/advisories/GHSA-72m9-7c8x-pmmw
github.com/librenms/librenms/blob/a61c11db7e8ef6a437ab55741658be2be7d14d34/app/Http/Controllers/ServiceTemplateController.php#L67C23-L67C23
github.com/librenms/librenms/commit/19344f0584d4d6d4526fdf331adc60530e3f685b
github.com/librenms/librenms/security/advisories/GHSA-72m9-7c8x-pmmw
nvd.nist.gov/vuln/detail/CVE-2024-32479
7.1 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
6.9 Medium
AI Score
Confidence
High
0.0004 Low
EPSS
Percentile
15.8%