CVE-2024-47525

LibreNMS, an open-source PHP/MySQL/SNMP-based network monitoring system, contains a stored cross-site scripting (XSS) flaw (CWE-79) in its Alert Rules feature. An authenticated user can inject arbitrary JavaScript into the 'Title' field of an alert rule; the script then executes in the browsers of other users who view that rule, running in the context of their sessions. Successful exploitation can compromise other users' accounts and enable unauthorized actions within LibreNMS, though the network vector requires low privileges and user interaction (CVSS 3.1: 5.4, Scope: Changed). All LibreNMS deployments running versions before 24.9.0 are affected, with internet-exposed instances facing the greatest risk from lower-privileged or malicious insiders and compromised accounts. As of now there is no CISA KEV listing, but one public reference (the GitHub security advisory GHSA-j2j9-7pr6-xqwv) documents the issue, and EPSS assigns a relatively high 29.6% probability of exploitation within 30 days.

What to do: Upgrade LibreNMS to 24.9.0 or later, which fixes the issue. Until then, restrict creation and editing of Alert Rules to trusted administrator accounts, review existing alert rule titles for injected HTML/JavaScript, and consider sanitizing the Title field at the web application firewall or reverse-proxy layer for internet-exposed instances.