-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| librenms/librenms | composer | <= 22.8.0 | 22.9.0 |
PHPPHPMiggo AIRoot Cause AnalysisThe vulnerability stems from unescaped output of user-controlled fields in the schedule maintenance interface. The patch adds htmlentities() encoding to three fields in AlertScheduleController.php's formatItem method. This function was responsible for preparing data for display in the web UI. The lack of output encoding on these specific fields (title, notes, recurring_day) prior to version 22.9.0 allowed attackers to store malicious JavaScript that would execute when viewed. The direct correlation between the vulnerable fields mentioned in the advisory and the patched code confirms this function's role in the vulnerability.
Ongoing coverage of React2Shell