Rook1337

**Name of the Vulnerable Software and Affected Versions** LibreNMS versions prior to 24.4.0 **Description** The issue is related to improper sanitization on the `Service` template name, which can lead to stored Cross-site Scripting. This can be exploited by modifying the template name with crafted JavaScript code, allowing an attacker to execute arbitrary code when the delete button is clicked. The vulnerability can lead to cookie stealing or an attacker executing other features using this exploit. **Recommendations** For versions prior to 24.4.0, update to version 24.4.0 to fix the vulnerability. As a temporary workaround, consider restricting access to the `Service` template name field to minimize the risk of exploitation. Additionally, avoid using the `Service` template name field until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** LibreNMS versions prior to 23.11.0 **Description** The issue allows a low-privilege user to enumerate devices on LibreNMS with their id or hostname by accessing a request sent to `graph.php` when they access their device dashboard. This enables the low-privilege user to see all devices registered by admin users. **Recommendations** For versions prior to 23.11.0, upgrade to release version 23.11.0 or later to address the vulnerability. As a temporary workaround, consider implementing privilege access control features to check if low-privilege users have access to specific devices or not. Restrict access to the `graph.php` endpoint to minimize the risk of exploitation. Avoid using the `device` parameter in the affected API endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** LibreNMS versions prior to 23.11.0 **Description** The issue is a cross-site scripting (XSS) vulnerability in the device group popups. This occurs when the application does not properly sanitize inputs, allowing an attacker to execute malicious JavaScript code. The vulnerability can be exploited by creating a device group with a malicious name, such as `"><img src=x onerror=alert(1);>`, and then deleting the device group, which triggers the XSS payload. The estimated number of potentially affected devices is not provided. There are no known real-world incidents where this issue was exploited. **Recommendations** For LibreNMS versions prior to 23.11.0, upgrade to release version 23.11.0 or later to address the vulnerability. As a temporary workaround, consider restricting access to the device group popups until the issue is resolved. Avoid using unsanitized input in the device group names to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** LibreNMS versions prior to 23.11.0 **Description** The issue concerns the login method in LibreNMS, which lacks a rate limit, allowing an attacker to potentially gain access to user accounts through brute force attacks. The login method uses a GET request for authentication, which is not recommended as it may store user credentials in web server logs. There are no known workarounds for this issue. **Recommendations** For versions prior to 23.11.0, upgrade to version 23.11.0 to address the issue. As a temporary workaround, consider restricting access to the login endpoint or implementing rate limiting on the `/` endpoint to minimize the risk of exploitation. Avoid using the `password` parameter in the affected API endpoint until the issue is resolved.