Cross-site Scripting in OpenNMS Horizon

TRUNG BÌNH 4.8CVE-2021-25929 · GHSA-jmv4-73v2-pvgc · Công bố 20/05/2021 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2021-25929 là lỗ hổng mức TRUNG BÌNH (CVSS 4.8) ảnh hưởng org.opennms:opennms, horizon (opennms), meridian (opennms).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 1.0%, cao hơn 63.4% các lỗ hổng khác.
Cách xử lý: cập nhật lên 27.1.1, 2019.1.19, 2020.1.7 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
org.opennms:opennms Maven	`≥ 1.0.0, < 27.1.1`	`27.1.1`
horizon opennms	`≥ 1.0, < 27.1.1`	`27.1.1`
meridian opennms	`≥ 2015.1.0, < 2019.1.19≥ 2020.1.0, < 2020.1.7`	`2019.1.192020.1.7`

Mô tả

In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1 are vulnerable to Stored Cross-Site Scripting since there is no validation on the input being sent to the name parameter in noticeWizard endpoint. Due to this flaw an authenticated attacker could inject arbitrary script and trick other admin users into downloading malicious files.

Mô tả của NVD

In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1 are vulnerable to Stored Cross-Site Scripting since there is no validation on the input being sent to the `name` parameter in `noticeWizard` endpoint. Due to this flaw an authenticated attacker could inject arbitrary script and trick other admin users into downloading malicious files.