CVE-2024-47528: LibreNMS vulnerable to Stored Cross-site Scripting via File Upload

October 1, 2024 (updated December 19, 2024)

Stored Cross-Site Scripting (XSS) can archive via Uploading a new Background for a Custom Map.

References

github.com/advisories/GHSA-x8gm-j36p-fppf
github.com/librenms/librenms
github.com/librenms/librenms/commit/d959bf1b366319eda16e3cd6dfda8a22beb203be
github.com/librenms/librenms/security/advisories/GHSA-x8gm-j36p-fppf
nvd.nist.gov/vuln/detail/CVE-2024-47528

Detect and mitigate CVE-2024-47528 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →