--- title: "CVE-2024-47523" date: "2024-10-01T07:00:00+00:00" url: "https://checkmarx.com/zero/vulnerabilities/cve-2024-47523/" --- # CVE-2024-47523 [Disclosed vulnerabilities](https://checkmarx.com/zero/vulnerabilities/) Fixed: Sep 29, 2024 CVE-2024-47523 **Published:** Oct 1, 2024 CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') 7.5 High Severity librenms Stored-XSS XSS RS Raphael Silva Reported by Checkmarx Zero Details Overview ## Summary A Stored Cross-Site Scripting (XSS) vulnerability in the “Alert Transports” feature of the `@LibreNMS/LibreNMS` project allows authenticated users to inject arbitrary JavaScript through the “Details” section of an alert transport. The injected script executes in other users’ sessions when transport details are viewed, potentially compromising accounts and enabling unauthorized actions. ## Product This vulnerability affects LibreNMS versions prior to 24.9.0 in `librenms/includes/html/print-alert-transports.php`. ## Impact This vulnerability can lead to the execution of malicious code in the context of other users’ sessions, potentially compromising their accounts and allowing unauthorized actions. ## Steps to reproduce 1. Log into the LibreNMS web interface. 2. Create a new alert transport and enter the following payload into any field that appears in the **Details** section: `test1` 3. Save the transport and in LibreNMS, view or process the alert transport details. 4. Observe that the injected script executes, displaying an alert popup. ### Expected result: An alert popup appears with the message `1337`, demonstrating that the injected JavaScript executed successfully. ## Remediation Fixed in LibreNMS 24.9.0 by properly escaping `$instance->displayDetails()` in `print-alert-transports.php`, preventing untrusted input from being inserted as HTML. ## Credit This issue was discovered and reported by Checkmarx Security Researcher [Raphael Silva](https://www.linkedin.com/in/raphaelcssilva/). ## Resources 1. [GHSA-7f84-28qh-9486](https://github.com/advisories/GHSA-7f84-28qh-9486) 2. [Fix commit](https://github.com/librenms/librenms/commit/ee1afba003d33667981e098c83295f599d88439c) 3. [NVD entry for CVE-2024-47523](https://nvd.nist.gov/vuln/detail/CVE-2024-47523) 0 High Severity CVSS v3.1 Score 7.5 CVSS v3.1 Vectors- Attack Vector: Network - Attack Complexity: Low - Privileges Required: High - User Interaction: Required - Scope: Changed - Confidentiality Impact: High - Integrity Impact: Low - Availability Impact: Low Advisory Timeline1. Discovered Jul 31, 2024 2. Disclosed Aug 19, 2024 3. Fixed Sep 29, 2024 Patch released in LibreNMS 24.9.0 ## Explore more findings [27 Nov 2025 CVE-2025-34281 Stored Cross-Site Scripting (XSS) in ThingsBoard 6.2 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-34281/) [17 Jan 2025 CVE-2025-0825 HTTP Response Splitting in cpp-httplib 6.9 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-0825/) [17 Jun 2025 CVE-2025-6050 Stored Cross-Site Scripting (XSS) in Mezzanine CMS Admin Interface 4.8 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-6050/) [12 Dec 2024 CVE-2024-8374 Code Injection in UltiMaker Cura 7.8 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-8374/) [14 Nov 2024 CVE-2024-52526 Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Tab 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-52526/) [14 Nov 2024 CVE-2024-51497 Stored Cross-site Scripting in @LibreNMS/LibreNMS Custom OID Tab 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51497/) [14 Nov 2024 CVE-2024-51496 Reflected Cross-site Scripting in @LibreNMS/LibreNMS /wireless and /health endpoints 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51496/) [ 14 Nov 2024 CVE-2024-51495 Stored Cross-site Scripting in @LibreNMS/LibreNMS Device Overview `overwrite\_ip` Field 7.5 Visit the page ](https://checkmarx.com/zero/vulnerabilities/cve-2024-51495/) [14 Nov 2024 CVE-2024-51494 Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51494/) [14 Nov 2024 CVE-2024-50352 Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Section of Device Overview 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50352/) [14 Nov 2024 CVE-2024-50351 Reflected Cross-site Scripting in @LibreNMS/LibreNMS Logs Tab 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50351/) [14 Nov 2024 CVE-2024-50350 Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings Port Group 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50350/)