CVE-2025-23201: Reflected Cross-site Scripting on error alert in librenms
First published: Thu Jan 16 2025(Updated: )
librenms is a community-based GPL-licensed network monitoring system. Affected versions are subject to Cross-site Scripting (XSS) on the parameters:`/addhost` -> param: community. Librenms versions up to 24.10.1 allow remote attackers to inject malicious scripts. When a user views or interacts with the page displaying the data, the malicious script executes immediately, leading to potential unauthorized actions or data exposure. This issue has been addressed in release version 24.11.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Credit: security-advisories@github.com security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| composer/librenms/librenms | <=24.10.1 | 24.11.0 |
| LibreNMS | <24.11.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2025-23201?
CVE-2025-23201 has a medium severity rating due to the potential for Cross-site Scripting (XSS) attacks.
How do I fix CVE-2025-23201?
To mitigate CVE-2025-23201, upgrade to Librenms version 24.11.0 or later.
What versions are affected by CVE-2025-23201?
Librenms versions up to and including 24.10.1 are affected by CVE-2025-23201.
What kind of attack can CVE-2025-23201 facilitate?
CVE-2025-23201 can facilitate Cross-site Scripting (XSS) attacks through the `/addhost` parameter.
Who is impacted by CVE-2025-23201?
Remote attackers can exploit CVE-2025-23201 to inject malicious scripts affecting users of vulnerable Librenms versions.
- agent/weakness
- agent/first-publish-date
- agent/title
- agent/type
- agent/references
- agent/source
- agent/author
- collector/github-advisory
- source/GitHub
- alias/GHSA-g84x-g96g-rcjc
- alias/CVE-2025-23201
- agent/software-canonical-lookup
- collector/epss-latest
- source/FIRST
- agent/epss
- collector/mitre-cve
- source/MITRE
- collector/github-advisory-latest
- collector/nvd-cve
- source/NVD
- agent/severity
- agent/last-modified-date
- agent/tags
- agent/softwarecombine
- agent/description
- agent/event
- collector/nvd-api
- package-manager/composer
- vendor/librenms
- canonical/librenms