Cross-site Scripting in OpenNMS Horizon

TRUNG BÌNH 4.8CVE-2021-25933 · GHSA-jjhw-5mxp-2g2q · Công bố 20/05/2021 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2021-25933 là lỗ hổng mức TRUNG BÌNH (CVSS 4.8) ảnh hưởng org.opennms:opennms, horizon (opennms), meridian (opennms).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 1.0%, cao hơn 64.1% các lỗ hổng khác.
Cách xử lý: cập nhật lên 27.1.1, 2019.1.19, 2020.1.7 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
org.opennms:opennms Maven	`≥ 1.0.0, < 27.1.1`	`27.1.1`
horizon opennms	`≥ 1.0, < 27.1.1`	`27.1.1`
meridian opennms	`≥ 2015.1.0, < 2019.1.19≥ 2020.1.0, < 2020.1.7`	`2019.1.192020.1.7`

Mô tả

In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1 are vulnerable to Stored Cross-Site Scripting, since the function validateFormInput() performs improper validation checks on the input sent to the groupName and groupComment parameters. Due to this flaw, an authenticated attacker could inject arbitrary script and trick other admin users into downloading malicious files which can cause severe damage to the organization using opennms.

Mô tả của NVD

In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1 are vulnerable to Stored Cross-Site Scripting, since the function `validateFormInput()` performs improper validation checks on the input sent to the `groupName` and `groupComment` parameters. Due to this flaw, an authenticated attacker could inject arbitrary script and trick other admin users into downloading malicious files which can cause severe damage to the organization using opennms.