CVE-2018-18478

Severity: medium (CVSS 6.1 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2018-10-18 · updated 2026-06-17
Weakness: CWE-79

Description

Persistent Cross-Site Scripting (XSS) issues in LibreNMS before 1.44 allow remote attackers to inject arbitrary web script or HTML via the dashboard_name parameter in the /ajax_form.php resource, related to html/includes/forms/add-dashboard.inc.php, html/includes/forms/delete-dashboard.inc.php, and html/includes/forms/edit-dashboard.inc.php.

Affected products

librenms: before 1.44 — fixed in 1.44

How to fix

Upgrade to a fixed version: librenms 1.44. Check the vendor advisory for mitigations.

References

https://github.com/librenms/librenms/issues/9170
https://github.com/librenms/librenms/pull/9171
https://github.com/librenms/librenms/releases/tag/1.44
https://hackpuntes.com/cve-2018-18478-libre-nms-1-43-cross-site-scripting-persistente/
https://github.com/librenms/librenms/issues/9170
https://github.com/librenms/librenms/pull/9171
https://github.com/librenms/librenms/releases/tag/1.44
https://hackpuntes.com/cve-2018-18478-libre-nms-1-43-cross-site-scripting-persistente/

Get alerted when CVE-2018-18478 or the next vulnerability affects your stack