CVE-2025-23199 json
Stored XSS-LibreNMS-Ports in librenms
published 2025-01-16 21 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-0085 , GHSA-27vf-3g4f-6jp7
- cvss
- 4.6
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.3%
- EPSS 1.3% chance of exploitation in 30 days, percentile 70%
- public exploits
- 0
- none known
Summary
librenms is a community-based GPL-licensed network monitoring system. Affected versions are subject to a stored XSS on the parameter: `/ajax_form.php` -> param: descr. Librenms version up to 24.10.1 allow remote attackers to inject malicious scripts. When a user views or interacts with the page displaying the data, the malicious script executes immediately, leading to potential unauthorized actions or data exposure. This issue has been addressed in release version 24.11.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Patch / fix
- packagist librenms/librenms 24.11.0
- librenms librenms 24.11.0
- github.com/librenms/librenms@9d07d16 commit
- github.com/librenms/librenms#16721 pull request
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 21 mo ago
Exploit prediction
1.30% chance of exploitation in the next 30 days, higher than 70% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/librenms/librenms/security/advisories/GHSA-27vf-3g4f-6jp7 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 4.6 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N |
| GitHub | 3.1 | 4.6 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N |
| NVD | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | librenms/librenms | <24.11.0 |
24.11.0 |
Affected products
- librenms librenms
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
github.com
/librenms/librenms/pull/16721
web
-
github.com
/librenms/librenms/commit/9d07d166b87634091dcf21c62b28f9b42a3118c4
web
-
github.com
/librenms/librenms/security/advisories/GHSA-27vf-3g4f-6jp7
web, exploit, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2025-23199
advisory
-
github.com
/librenms/librenms
package
Sources
- CVE List CVE-2025-23199
- GitHub Advisory GHSA-27vf-3g4f-6jp7
- NVD CVE-2025-23199
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.