Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-dff6-r5mp-p3d5
Vulnerability ID VCID-dff6-r5mp-p3d5
Aliases CVE-2024-47525
GHSA-j2j9-7pr6-xqwv
Summary LibreNMS has Stored Cross-site Scripting vulnerability in "Alert Rules" feature A Stored Cross-Site Scripting (XSS) vulnerability in the "Alert Rules" feature allows authenticated users to inject arbitrary JavaScript through the "Title" field. This vulnerability can lead to the execution of malicious code in the context of other users' sessions, potentially compromising their accounts and allowing unauthorized actions.
Status Published
Exploitability 0.5
Weighted Severity 6.8
Risk 3.4
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.07363 https://api.first.org/data/v1/epss?cve=CVE-2024-47525
epss 0.07363 https://api.first.org/data/v1/epss?cve=CVE-2024-47525
epss 0.07363 https://api.first.org/data/v1/epss?cve=CVE-2024-47525
epss 0.07363 https://api.first.org/data/v1/epss?cve=CVE-2024-47525
epss 0.07363 https://api.first.org/data/v1/epss?cve=CVE-2024-47525
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-j2j9-7pr6-xqwv
cvssv3.1 7.5 https://github.com/librenms/librenms
cvssv4 5.0 https://github.com/librenms/librenms
generic_textual MODERATE https://github.com/librenms/librenms
cvssv3.1 7.5 https://github.com/librenms/librenms/blob/9455173edce6971777cf6666d540eeeaf6201920/includes/html/print-alert-rules.php#L405
cvssv4 5.0 https://github.com/librenms/librenms/blob/9455173edce6971777cf6666d540eeeaf6201920/includes/html/print-alert-rules.php#L405
generic_textual MODERATE https://github.com/librenms/librenms/blob/9455173edce6971777cf6666d540eeeaf6201920/includes/html/print-alert-rules.php#L405
ssvc Track https://github.com/librenms/librenms/blob/9455173edce6971777cf6666d540eeeaf6201920/includes/html/print-alert-rules.php#L405
cvssv3.1 7.5 https://github.com/librenms/librenms/commit/7620d220e48563938d869da7689b8ac3f7721490
cvssv4 5.0 https://github.com/librenms/librenms/commit/7620d220e48563938d869da7689b8ac3f7721490
generic_textual MODERATE https://github.com/librenms/librenms/commit/7620d220e48563938d869da7689b8ac3f7721490
ssvc Track https://github.com/librenms/librenms/commit/7620d220e48563938d869da7689b8ac3f7721490
cvssv3.1 7.5 https://github.com/librenms/librenms/security/advisories/GHSA-j2j9-7pr6-xqwv
cvssv3.1_qr MODERATE https://github.com/librenms/librenms/security/advisories/GHSA-j2j9-7pr6-xqwv
cvssv4 5.0 https://github.com/librenms/librenms/security/advisories/GHSA-j2j9-7pr6-xqwv
generic_textual MODERATE https://github.com/librenms/librenms/security/advisories/GHSA-j2j9-7pr6-xqwv
ssvc Track https://github.com/librenms/librenms/security/advisories/GHSA-j2j9-7pr6-xqwv
cvssv3.1 7.5 https://nvd.nist.gov/vuln/detail/CVE-2024-47525
cvssv4 5.0 https://nvd.nist.gov/vuln/detail/CVE-2024-47525
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2024-47525
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2024-47525
https://github.com/librenms/librenms
https://github.com/librenms/librenms/blob/9455173edce6971777cf6666d540eeeaf6201920/includes/html/print-alert-rules.php#L405
https://github.com/librenms/librenms/commit/7620d220e48563938d869da7689b8ac3f7721490
CVE-2024-47525 https://nvd.nist.gov/vuln/detail/CVE-2024-47525
GHSA-j2j9-7pr6-xqwv https://github.com/advisories/GHSA-j2j9-7pr6-xqwv
GHSA-j2j9-7pr6-xqwv https://github.com/librenms/librenms/security/advisories/GHSA-j2j9-7pr6-xqwv
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:L Found at https://github.com/librenms/librenms
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:H/SI:L/SA:L/E:P Found at https://github.com/librenms/librenms
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:L Found at https://github.com/librenms/librenms/blob/9455173edce6971777cf6666d540eeeaf6201920/includes/html/print-alert-rules.php#L405
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:H/SI:L/SA:L/E:P Found at https://github.com/librenms/librenms/blob/9455173edce6971777cf6666d540eeeaf6201920/includes/html/print-alert-rules.php#L405
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2024-10-02T13:00:57Z/ Found at https://github.com/librenms/librenms/blob/9455173edce6971777cf6666d540eeeaf6201920/includes/html/print-alert-rules.php#L405
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:L Found at https://github.com/librenms/librenms/commit/7620d220e48563938d869da7689b8ac3f7721490
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:H/SI:L/SA:L/E:P Found at https://github.com/librenms/librenms/commit/7620d220e48563938d869da7689b8ac3f7721490
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2024-10-02T13:00:57Z/ Found at https://github.com/librenms/librenms/commit/7620d220e48563938d869da7689b8ac3f7721490
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:L Found at https://github.com/librenms/librenms/security/advisories/GHSA-j2j9-7pr6-xqwv
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:H/SI:L/SA:L/E:P Found at https://github.com/librenms/librenms/security/advisories/GHSA-j2j9-7pr6-xqwv
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2024-10-02T13:00:57Z/ Found at https://github.com/librenms/librenms/security/advisories/GHSA-j2j9-7pr6-xqwv
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:L Found at https://nvd.nist.gov/vuln/detail/CVE-2024-47525
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:H/SI:L/SA:L/E:P Found at https://nvd.nist.gov/vuln/detail/CVE-2024-47525
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.91863
EPSS Score 0.07363
Published At June 5, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-04T16:22:19.910027+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/librenms/librenms/CVE-2024-47525.yml 38.6.0