| Package | Affected versions | Patched versions |
|---|---|---|
| librenms/librenms | < 25.7.0 | 25.7.0 |
| librenms | < 25.7.0 | 25.7.0 |
Reflected-XSS in report_this function in librenms/includes/functions.php
Recently, it was discovered that the report_this function had improper filtering (htmlentities function was incorrectly used in a href environment), which caused the project_issues parameter to trigger an XSS vulnerability.
The Vulnerable Sink: https://github.com/librenms/librenms/blob/master/includes/functions.php#L444
GET
project_issues=javascript:alert(document.cookie)
XSS vulnerabilities allow attackers to execute malicious scripts in users' browsers, enabling unauthorized access to sensitive data, session hijacking, or malware distribution.
It is recommended to filter dangerous protocols, e.g. javascript:/file:.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free