Headline
CVE-2022-3231: Fix scheduled maintenance xss (#14360) · librenms/librenms@0805002
Cross-site Scripting (XSS) - Stored in GitHub repository librenms/librenms prior to 22.9.0.
@@ -65,8 +65,8 @@ protected function sortFields($request)
public function formatItem($schedule)
{
return [
‘title’ => $schedule->title,
‘notes’ => $schedule->notes,
‘title’ => htmlentities($schedule->title),
‘notes’ => htmlentities($schedule->notes),
‘id’ => $schedule->schedule_id,
‘start’ => $schedule->recurring ? ‘’ : $schedule->start->toDateTimeString(‘minutes’),
‘end’ => $schedule->recurring ? ‘’ : $schedule->end->toDateTimeString(‘minutes’),
@@ -75,7 +75,7 @@ public function formatItem($schedule)
‘end_recurring_dt’ => $schedule->recurring ? $schedule->end_recurring_dt : '’,
‘end_recurring_hr’ => $schedule->recurring ? $schedule->end_recurring_hr : '’,
‘recurring’ => $schedule->recurring ? __(‘Yes’) : __(‘No’),
‘recurring_day’ => $schedule->recurring ? implode(',’, $schedule->recurring_day) : '’,
‘recurring_day’ => $schedule->recurring ? htmlentities(implode(',’, $schedule->recurring_day)) : '’,
‘status’ => $schedule->status,
];
}
Related news
LibreNMS versions 22.8.0 and prior allow attackers to execute arbitrary JavaScript code via the Schedule Maintenance `Title` parameter. A patch is available and anticipated to be part of version 22.9.0.