CVE-2025-62411

MEDIUM5.5EPSS 0.01%

LibreNMS has a Stored XSS vulnerability in its Alert Transport name field

發布日:2025/10/16修改日:2025/10/16

描述

### Summary LibreNMS <= 25.8.0 contains a **Stored Cross-Site Scripting (XSS)** vulnerability in the Alert Transports management functionality. When an administrator creates a new Alert Transport, the value of the `Transport name` field is stored and later rendered in the **Transports** column of the **Alert Rules** page without proper input validation or output encoding. This leads to arbitrary JavaScript execution in the admin’s browser. ### Details * **Injection point:** `Transport name` field in `/alert-transports`. * **Execution point:** **Transports** column in `/alert-rules`. * **Scope:** Only administrators can create Alert Transports, and only administrators can view the affected Alert Rules page. Therefore, both exploitation and impact are limited to admin users. ### Steps to reproduce 1. Log in with an administrator account. 2. Navigate to: ``` http://localhost:8000/alert-transports ``` 3. Click **Create alert transport** and provide the following values: * **Transport name:** ```html 'onfocus='alert(1)' autofocus= ``` * **Default Alert:** `ON` * **Email:** `[email protected]` (or any valid email) Save the transport. 4. Navigate to ```http://localhost:8000/alert-rules```. A popup `alert(1)` is triggered, confirming that the payload executes. <img width="1829" height="396" alt="image" src="https://github.com/user-attachments/assets/932ba17d-214d-4253-80b8-62539d1cfa28" /> ### Impact Only accounts with the admin role who access the **Alert Rules** page (`http://localhost:8000/alert-rules`) are affected.

受影響套件(1)

Packagist/librenms/librenmsfrom 0, < 25.10.0

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 3.1	MEDIUM5.5	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

描述

受影響套件(1)

CVSS 分數

參考連結(6)