Skip to content

Cross-site Scripting in LibreNMS

Moderate severity GitHub Reviewed Published Sep 9, 2021 to the GitHub Advisory Database • Updated Sep 19, 2023

Package

composer librenms/librenms (Composer)

Affected versions

< 21.3.0

Patched versions

21.3.0

Description

In LibreNMS < 21.3.0, a stored XSS vulnerability was identified in the API Access page due to insufficient sanitization of the $api->description variable. As a result, arbitrary Javascript code can get executed.

References

Published by the National Vulnerability Database Sep 8, 2021
Reviewed Sep 9, 2021
Published to the GitHub Advisory Database Sep 9, 2021
Last updated Sep 19, 2023

Severity

Moderate
5.4
/ 10

CVSS base metrics

Attack vector
Network
Attack complexity
Low
Privileges required
Low
User interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weaknesses

CVE ID

CVE-2021-31274

GHSA ID

GHSA-2r2w-jrh2-p4gr

Source code

Checking history
See something to contribute? Suggest improvements for this vulnerability.