CVE-2022-3516: 
PHP vulnerability analysis and mitigation

Cross-site Scripting (XSS) - Stored vulnerability was discovered in GitHub repository librenms/librenms prior to version 22.10.0. The vulnerability was assigned CVE-2022-3516 and was related to improper handling of titles in the notifications system (CVE Mitre, NVD).

The vulnerability was a stored XSS issue in the notifications system where title values were not properly sanitized before being displayed to users. The issue was present in the notifications.inc.php file where raw title values were directly output without proper HTML encoding (GitHub Commit).

A successful exploitation of this vulnerability could allow attackers to inject and execute malicious JavaScript code in the context of other users' browsers who view the notifications. This could potentially lead to session hijacking, defacement, or theft of sensitive browser data.

The vulnerability required an attacker to have access to create notifications in the system with specially crafted title values that include malicious JavaScript code. When other users viewed these notifications, the malicious code would execute in their browsers (Huntr).

The vulnerability was fixed in LibreNMS version 22.10.0 by implementing proper HTML encoding of notification titles using the htmlentities() function. Users should upgrade to version 22.10.0 or later to protect against this vulnerability (GitHub Commit).