-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from unsanitized use of $device['hostname'] when building URLs in the $tabs array. The original code concatenated $device['hostname'] directly into the URL parameters without escaping (e.g., 'ajax_output.php?...&hostname=' . $device['hostname']). Attackers could inject malicious attributes like onfocus into the hostname, which would then be rendered in the HTML. The patch explicitly adds htmlentities()` to sanitize the hostname, confirming that the lack of escaping in these lines was the root cause. The code responsible for constructing the URLs in the $tabs array is the primary vulnerable component.
PHPPHP| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| librenms/librenms | composer | <= 24.9.1 | 24.10.0 |
This vulnerability allows authenticated users to execute arbitrary JavaScript in the context of other users' sessions when they visit the "Capture Debug Information" page of the device. The attacker can redirect the user to a malicious domain and capture non-httponly cookies, potentially compromising the user's account and allowing unauthorized actions.
KEV Misses 88% of Exploited CVEs- Get the report