CVE-2022-4068

CVE-2022-4068 affects LibreNMS, allowing a low-privileged user to re-enable their own account if an administrator disabled it, provided they maintain a valid session. More critically, the vulnerability includes a stored Cross-Site Scripting (XSS) flaw (CWE-79) in the admin user overview due to improper username sanitization. This XSS allows an attacker to execute arbitrary JavaScript in an administrator's browser, potentially leading to unauthorized actions. Rated Medium severity with a CVSS score of 5.4, the attack requires low privileges and user interaction (UI:R), but its impact is limited to partial confidentiality and integrity (C:L/I:L). The EPSS score of 0.54367 indicates a higher-than-average probability of exploitation compared to most CVEs. Currently, there is no evidence of active exploitation, and no public exploit code is available on platforms like Metasploit or ExploitDB. The vulnerability has received no community discussion or media coverage, suggesting a low level of public awareness or attention.