GHSA-6c5q-fg3g-qhhvmedium5.4
LibreNMS stored cross-site scripting (XSS) vulnerability in the Device Settings section
The advisory, in context
A stored cross-site scripting (XSS) vulnerability in the Device Settings section of LibreNMS v24.9.0 to v24.10.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Display Name parameter.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
librenms/librenms Packagist
Ecosystem versions
From 24.9.0 before 24.11.0
Fixed in 24.11.0
4 explicitly affected versions
24.10.0, 24.10.1, 24.9.0, 24.9.1
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "24.9.0"
},
{
"fixed": "24.11.0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"24.10.0",
"24.10.1",
"24.9.0",
"24.9.1"
]
}