Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWpqaHctNW14cC0yZzJx

Cross-site Scripting in OpenNMS Horizon

In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1 are vulnerable to Stored Cross-Site Scripting, since the function validateFormInput() performs improper validation checks on the input sent to the groupName and groupComment parameters. Due to this flaw, an authenticated attacker could inject arbitrary script and trick other admin users into downloading malicious files which can cause severe damage to the organization using opennms.

Permalink: https://github.com/advisories/GHSA-jjhw-5mxp-2g2q
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWpqaHctNW14cC0yZzJx
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: over 3 years ago
Updated: almost 2 years ago

CVSS Score: 4.8
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

EPSS Percentage: 0.00088
EPSS Percentile: 0.39131

Identifiers: GHSA-jjhw-5mxp-2g2q, CVE-2021-25933
References:

• https://nvd.nist.gov/vuln/detail/CVE-2021-25933
• https://github.com/OpenNMS/opennms/commit/8a97e6869d6e49da18b208c837438ace80049c01,
• https://github.com/OpenNMS/opennms/commit/eb08b5ed4c5548f3e941a1f0d0363ae4439fa98c
• https://github.com/OpenNMS/opennms/commit/f3ebfa3da5352b4d57f238b54c6db315ad99f10e
• https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25933
• https://github.com/advisories/GHSA-jjhw-5mxp-2g2q

Repository: https://github.com/OpenNMS/opennms
Blast Radius: 1.0

Affected Packages