Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-tdcf-uak3-gfec
Vulnerability ID VCID-tdcf-uak3-gfec
Aliases CVE-2024-49759
GHSA-888j-pjqh-fx58
Summary LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the "Manage User Access" page allows authenticated users to inject arbitrary JavaScript through the "bill_name" parameter when creating a new bill. This vulnerability can lead to the execution of malicious code when visiting the "Bill Access" dropdown in the user's "Manage Access" page, potentially compromising user sessions and allowing unauthorized actions. This vulnerability is fixed in 24.10.0.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00546 https://api.first.org/data/v1/epss?cve=CVE-2024-49759
epss 0.00546 https://api.first.org/data/v1/epss?cve=CVE-2024-49759
cvssv3.1 7.5 https://github.com/librenms/librenms
generic_textual HIGH https://github.com/librenms/librenms
cvssv3.1 4.8 https://github.com/librenms/librenms/commit/237f4d2e818170171dfad6efad36a275cd2ba8d0
cvssv3.1 7.5 https://github.com/librenms/librenms/commit/237f4d2e818170171dfad6efad36a275cd2ba8d0
generic_textual HIGH https://github.com/librenms/librenms/commit/237f4d2e818170171dfad6efad36a275cd2ba8d0
ssvc Track https://github.com/librenms/librenms/commit/237f4d2e818170171dfad6efad36a275cd2ba8d0
cvssv3.1 4.8 https://github.com/librenms/librenms/security/advisories/GHSA-888j-pjqh-fx58
cvssv3.1 7.5 https://github.com/librenms/librenms/security/advisories/GHSA-888j-pjqh-fx58
generic_textual HIGH https://github.com/librenms/librenms/security/advisories/GHSA-888j-pjqh-fx58
ssvc Track https://github.com/librenms/librenms/security/advisories/GHSA-888j-pjqh-fx58
cvssv3.1 7.5 https://nvd.nist.gov/vuln/detail/CVE-2024-49759
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2024-49759
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2024-49759
https://nvd.nist.gov/vuln/detail/CVE-2024-49759
237f4d2e818170171dfad6efad36a275cd2ba8d0 https://github.com/librenms/librenms/commit/237f4d2e818170171dfad6efad36a275cd2ba8d0
GHSA-888j-pjqh-fx58 https://github.com/advisories/GHSA-888j-pjqh-fx58
GHSA-888j-pjqh-fx58 https://github.com/librenms/librenms/security/advisories/GHSA-888j-pjqh-fx58
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:L Found at https://github.com/librenms/librenms
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N Found at https://github.com/librenms/librenms/commit/237f4d2e818170171dfad6efad36a275cd2ba8d0
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:L Found at https://github.com/librenms/librenms/commit/237f4d2e818170171dfad6efad36a275cd2ba8d0
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2024-11-15T16:52:28Z/ Found at https://github.com/librenms/librenms/commit/237f4d2e818170171dfad6efad36a275cd2ba8d0
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N Found at https://github.com/librenms/librenms/security/advisories/GHSA-888j-pjqh-fx58
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:L Found at https://github.com/librenms/librenms/security/advisories/GHSA-888j-pjqh-fx58
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2024-11-15T16:52:28Z/ Found at https://github.com/librenms/librenms/security/advisories/GHSA-888j-pjqh-fx58
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:L Found at https://nvd.nist.gov/vuln/detail/CVE-2024-49759
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.68263
EPSS Score 0.00546
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-10T18:31:05.367305+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2024/49xxx/CVE-2024-49759.json 38.6.0