CVE-2026-84191
LibreNMS before 26.5.0 contains stored cross-site scripting vulnerabilities in VRF display pages where mplsVpnVrfDescription, vrf_name, and mplsVpnVrfRouteDistinguisher fields from SNMP polling are rendered without sanitization. Attackers controlling a monitored network device can inject arbitrary JavaScript through SNMP responses that executes in the browser of any user viewing VRF-related pages.
Açıklama ve Etki
LibreNMS before 26.5.0 contains stored cross-site scripting vulnerabilities in VRF display pages where mplsVpnVrfDescription, vrf_name, and mplsVpnVrfRouteDistinguisher fields from SNMP polling are rendered without sanitization. Attackers controlling a monitored network device can inject arbitrary JavaScript through SNMP responses that executes in the browser of any user viewing VRF-related pages.
Referanslar
Güvenli Doğrulama Notu
Bu sayfa saldırı gerçekleştiren payload'lar çalıştırmaz. Doğrulama; etkilenen ürün/sürümün envanterden kontrol edilmesi, üretici güvenlik duyurusunun incelenmesi ve güncellemenin uygulanması üzerinden yapılmalıdır.