Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.1

LibreNMS: Unauthorized code execution via web interface

CVE-2022-36746 · published 4 years ago
Summary

LibreNMS's web interface allows an attacker to inject malicious code, potentially allowing them to take control of the system or steal sensitive information. This affects all users of LibreNMS, particularly those who allow external access to the web interface. Update to the latest version to fix this vulnerability.

What to do
  • Update librenms librenms to version 22.7.0.
Affected software
Ecosystem VendorProductAffected versions
composer librenms librenms < 22.7.0
Fix: upgrade to 22.7.0
– librenms librenms 22.6.0
cpe:2.3:a:librenms:librenms:22.6.0:*:*:*:*:*:*:*
Original advisory text
LibreNMS v22.6.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component oxidized-cfg-check.inc.php.
LibreNMS v22.6.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component oxidized-cfg-check.inc.php.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
6.1 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published30 Aug 2022
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-325v-g5vx-whxc · GHSA
CVE-2022-36746 · NVD
CVE-2022-36746 · OSV
Track software like this
Free during beta