CVE-2023-48295: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring which includes support for a wide range of network hardware and operating systems. Affected versions are subject to a cross site scripting (XSS) vulnerability in the device group popups. This issue has been addressed in commit `faf66035ea` which has been included in release version 23.11.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2023-11-17T21:15Z
Repository: https://github.com/librenms/librenms
Language: PHP
Files changed: app/Http/Controllers/DeviceGroupController.php
Commit date: 2023-11-15 08:21:06 -0600
Commit message: Fix a few XSS vulnerabilities in device group popups (#15581)

I can't tell if the flasher ones are vulnerable, as flasher is still broken.
Diff: diff --git a/app/Http/Controllers/DeviceGroupController.php b/app/Http/Controllers/DeviceGroupController.php
index afd7740f63f..405aa730941 100644
--- a/app/Http/Controllers/DeviceGroupController.php
+++ b/app/Http/Controllers/DeviceGroupController.php
@@ -65,11 +65,11 @@ class DeviceGroupController extends Controller
 
         if ($request->type == 'static') {
             $deviceGroup->devices()->sync($request->devices);
         }
 
-        $flasher->addSuccess(__('Device Group :name created', ['name' => $deviceGroup->name]));
+        $flasher->addSuccess(__('Device Group :name created', ['name' => htmlentities($deviceGroup->name)]));
 
         return redirect()->route('device-groups.index');
     }
 
     /**
@@ -141,11 +141,11 @@ class DeviceGroupController extends Controller
         }
 
         if ($deviceGroup->isDirty() || $devices_updated) {
             try {
                 if ($deviceGroup->save() || $devices_updated) {
-                    $flasher->addSuccess(__('Device Group :name updated', ['name' => $deviceGroup->name]));
+                    $flasher->addSuccess(__('Device Group :name updated', ['name' => htmlentities($deviceGroup->name)]));
                 } else {
                     $flasher->addError(__('Failed to save'));
 
                     return redirect()->back()->withInput();
                 }
@@ -168,11 +168,11 @@ class DeviceGroupController extends Controller
      * @return \Illuminate\Http\Response
      */
     public function destroy(DeviceGroup $deviceGroup)
     {
         if ($deviceGroup->serviceTemplates()->exists()) {
-            $msg = __('Device Group :name still has Service Templates associated with it. Please remove or update the Service Template accordingly', ['name' => $deviceGroup->name]);
+            $msg = __('Device Group :name still has Service Templates associated with it. Please remove or update the Service Template accordingly', ['name' => htmlentities($deviceGroup->name)]);
 
             return response($msg, 200);
         }
         $deviceGroup->delete();
 

Vulnerable code:         $flasher->addSuccess(__('Device Group :name created', ['name' => $deviceGroup->name]));
                    $flasher->addSuccess(__('Device Group :name updated', ['name' => $deviceGroup->name]));
            $msg = __('Device Group :name still has Service Templates associated with it. Please remove or update the Service Template accordingly', ['name' => $deviceGroup->name]);
Fixed code:         $flasher->addSuccess(__('Device Group :name created', ['name' => htmlentities($deviceGroup->name)]));
                    $flasher->addSuccess(__('Device Group :name updated', ['name' => htmlentities($deviceGroup->name)]));
            $msg = __('Device Group :name still has Service Templates associated with it. Please remove or update the Service Template accordingly', ['name' => htmlentities($deviceGroup->name)]);