CVE-2024-47528 - CVE House

Back to Database

Status published Medium CVE-2024-47528

LibreNMS Contains a Stored XSS via File Upload

4.6 CVSS

Vulnerability Description

LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. Stored Cross-Site Scripting (XSS) can be achieved by uploading a new Background for a Custom Map. Users with "admin" role can set background for a custom map, this allow the upload of SVG file that can contain XSS payload which will trigger on load. This led to Stored Cross-Site Scripting (XSS). The vulnerability is fixed in 24.9.0.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-47528

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from librenms

View All →

LibreNMS Alert Rule API Cross-Site Scripting Vulnerability

LibreNMS is vulnerable to SQL Injection (Boolean-Based Blind) in hostname parameter in ajax_output.php endpoint

LibreNMS has Weak Password Policy

LibreNMS vulnerable to Reflected Cross-Site Scripting (XSS) in endpoint `/maps/nodeimage` parameter `Image Name`

LibreNMS alert-rules Cross-Site Scripting Vulnerability

Affected Vendor

librenms

View all reports →

Affected Software

librenms

Vulnerable Versions:

< 24.9.0

Timeline

Official Publish: October 1st, 2024

Last Modified: December 19th, 2024

Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-116 CWE-434 CWE-79

MITRE ATT&CK TTPs

T1189 Drive-by Compromise

T1190 Exploit Public-Facing Application

T1059 Command and Scripting Interpreter

T1565.002 Stored Data Manipulation

T1505.003 Web Shell

T1105 Ingress Tool Transfer

Command and Control

T1059.007 JavaScript

T1539 Steal Web Session Cookie

T1213 Data from Information Repositories

T1567 Exfiltration Over Web Service

T1491.001 Defacement