CVE-2018-18478
Description
Persistent XSS in LibreNMS before 1.44 allows remote attackers to inject arbitrary web script via dashboard_name parameter.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Persistent XSS in LibreNMS before 1.44 allows remote attackers to inject arbitrary web script via dashboard_name parameter.
Vulnerability
Persistent Cross-Site Scripting (XSS) in LibreNMS before version 1.44 allows remote attackers to inject arbitrary web script or HTML via the dashboard_name parameter in the /ajax_form.php resource. The vulnerable code resides in html/includes/forms/add-dashboard.inc.php, delete-dashboard.inc.php, and edit-dashboard.inc.php. All versions prior to 1.44 are affected [1][2][4].
Exploitation
An attacker with network access to the LibreNMS web interface and the ability to create, edit, or delete dashboards (requires an authenticated user with appropriate permissions) can inject a malicious payload into the dashboard_name parameter. For example, using the new dashboard form, an attacker can enter `` as the dashboard name. The payload is stored and executed when other users view the dashboard list [4].
Impact
Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of the victim's browser session. This can lead to session hijacking, defacement, data theft, or other malicious actions, potentially compromising the entire LibreNMS instance [2][4].
Mitigation
Upgrade to LibreNMS version 1.44, released in September 2018, which fixes the issue by sanitizing the dashboard_name parameter [1][3]. No workarounds are provided; upgrading is the recommended mitigation.
AI Insight generated on May 22, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
librenms/librenmsPackagist | < 1.44 | 1.44 |
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
7- github.com/advisories/GHSA-9m82-f3wx-p625ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2018-18478ghsaADVISORY
- github.com/librenms/librenms/issues/9170ghsax_refsource_MISCWEB
- github.com/librenms/librenms/pull/9171ghsax_refsource_MISCWEB
- github.com/librenms/librenms/releases/tag/1.44ghsax_refsource_MISCWEB
- hackpuntes.com/cve-2018-18478-libre-nms-1-43-cross-site-scripting-persistenteghsaWEB
- hackpuntes.com/cve-2018-18478-libre-nms-1-43-cross-site-scripting-persistente/mitrex_refsource_MISC
News mentions
0No linked articles in our index yet.