---
title: "CVE-2024-50351"
date: "2024-11-14T07:00:00+00:00"
url: "https://checkmarx.com/zero/vulnerabilities/cve-2024-50351/"
---

# CVE-2024-50351

[Disclosed vulnerabilities](https://checkmarx.com/zero/vulnerabilities/)

Fixed: Nov 5, 2024

CVE-2024-50351  **Published:** Nov 14, 2024

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')  7.5 High Severity librenms logs Reflected XSS XSS

RS Raphael Silva  Reported by Checkmarx Zero

Details Overview

## Summary

A Reflected Cross-Site Scripting (XSS) vulnerability in the “logs” tab of a device in the `@LibreNMS/LibreNMS` project allows attackers to inject arbitrary JavaScript via the `section` parameter. The vulnerability stems from lack of sanitization in the `report_this()` function, causing the payload to be executed when the logs page is accessed.

## Product

This vulnerability affects LibreNMS versions prior to 24.10.0 in `librenms/includes/functions.php`.

## Impact

This vulnerability can lead to the execution of malicious code in the context of other users’ sessions, potentially compromising their accounts and allowing unauthorized actions.

## Steps to reproduce

1. Construct the following URL (adjust host and device ID accordingly):

    `http://<your_host>/device/device=1/tab=logs/section=<script>constructor['constructor'](atob('Y29uZmlybShkb2N1bWVudC5kb21haW4p'))();</script>`
2. Access the URL in a browser.
3. Observe the JavaScript executes immediately, displaying a confirmation dialog with the document domain.

### Expected result:

A confirmation dialog appears showing the current document domain, demonstrating execution of the injected script.

## Remediation

Fixed in LibreNMS 24.10.0 by sanitizing the `section` parameter in `report_this()`, ensuring user input is encoded before rendering.

## Credit

This issue was discovered and reported by Checkmarx Security Researcher [Raphael Silva](https://www.linkedin.com/in/raphaelcssilva/).

## Resources

1. [GHSA-v7w9-63xh-6r3w](https://github.com/advisories/GHSA-v7w9-63xh-6r3w)
2. [Fix commit](https://github.com/librenms/librenms/commit/6a14a9b)
3. [NVD entry for CVE-2024-50351](https://nvd.nist.gov/vuln/detail/CVE-2024-50351)

0  High Severity CVSS v3.1 Score

   7.5

CVSS v3.1 Vectors- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: High
- User Interaction: Required
- Scope: Changed
- Confidentiality Impact: High
- Integrity Impact: Low
- Availability Impact: Low

Advisory Timeline1. Discovered Oct 9, 2024
2. Disclosed Oct 10, 2024
3. Fixed Nov 5, 2024 Patch released in LibreNMS 24.10.0

## Explore more findings

[27 Nov 2025 CVE-2025-34281  Stored Cross-Site Scripting (XSS) in ThingsBoard   6.2  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-34281/) [17 Jan 2025 CVE-2025-0825  HTTP Response Splitting in cpp-httplib   6.9  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-0825/) [17 Jun 2025 CVE-2025-6050  Stored Cross-Site Scripting (XSS) in Mezzanine CMS Admin Interface   4.8  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-6050/) [12 Dec 2024 CVE-2024-8374  Code Injection in UltiMaker Cura   7.8  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-8374/) [14 Nov 2024 CVE-2024-52526  Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Tab   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-52526/) [14 Nov 2024 CVE-2024-51497  Stored Cross-site Scripting in @LibreNMS/LibreNMS Custom OID Tab   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51497/) [14 Nov 2024 CVE-2024-51496  Reflected Cross-site Scripting in @LibreNMS/LibreNMS /wireless and /health endpoints   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51496/) [  14 Nov 2024 CVE-2024-51495  Stored Cross-site Scripting in @LibreNMS/LibreNMS Device Overview `overwrite\_ip` Field   7.5  Visit the page ](https://checkmarx.com/zero/vulnerabilities/cve-2024-51495/) [14 Nov 2024 CVE-2024-51494  Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51494/) [14 Nov 2024 CVE-2024-50352  Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Section of Device Overview   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50352/) [14 Nov 2024 CVE-2024-50350  Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings Port Group   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50350/) [14 Nov 2024 CVE-2024-49764  Stored Cross-site Scripting in @LibreNMS/LibreNMS Capture Debug Information   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-49764/)