CVE-2025-23201

librenms is a community-based GPL-licensed network monitoring system. Affected versions are subject to Cross-site Scripting (XSS) on the parameters:`/addhost` -> param: community. Librenms versions up to 24.10.1 allow remote attackers to inject malicious scripts. When a user views or interacts with the page displaying the data, the malicious script executes immediately, leading to potential unauthorized actions or data exposure. This issue has been addressed in release version 24.11.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/librenms/librenms/security/advisories/GHSA-g84x-g96g-rcjc	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:librenms:librenms:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2025-01-16 23:15

Updated : 2025-03-25 14:57

NVD link : CVE-2025-23201

Mitre link : CVE-2025-23201

CVE.ORG link : CVE-2025-23201

JSON object : View

Products Affected

librenms

librenms

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2025-23201", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "published": "2025-01-16T23:15:08.880", "references": [{"url": "https://github.com/librenms/librenms/security/advisories/GHSA-g84x-g96g-rcjc", "tags": ["Exploit", "Vendor Advisory"], "source": "[email protected]"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "librenms is a community-based GPL-licensed network monitoring system. Affected versions are subject to Cross-site Scripting (XSS) on the parameters:`/addhost` -> param: community. Librenms versions up to 24.10.1 allow remote attackers to inject malicious scripts. When a user views or interacts with the page displaying the data, the malicious script executes immediately, leading to potential unauthorized actions or data exposure. This issue has been addressed in release version 24.11.0. Users are advised to upgrade. There are no known workarounds for this vulnerability."}, {"lang": "es", "value": " librenms es un sistema de monitorizaci\u00f3n de redes con licencia GPL basado en la comunidad. Las versiones afectadas est\u00e1n sujetas a Cross-site Scripting (XSS) en los par\u00e1metros: `/addhost` -> param: community. Las versiones de Librenms hasta la 24.10.1 permiten a atacantes remotos inyectar scripts maliciosos. Cuando un usuario visualiza o interact\u00faa con la p\u00e1gina que muestra los datos, el script malicioso se ejecuta inmediatamente, lo que lleva a posibles acciones no autorizadas o exposici\u00f3n de datos. Este problema se ha solucionado en la versi\u00f3n 24.11.0. Se recomienda a los usuarios que actualicen. No existen workarounds conocidos para esta vulnerabilidad."}], "lastModified": "2025-03-25T14:57:12.250", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:librenms:librenms:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2AEF7E05-D916-4B7C-ADCF-6BAFAD37551A", "versionEndExcluding": "24.11.0"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}