Cross-site Scripting in OpenNMS Horizon
Moderate severity
GitHub Reviewed
Published
May 25, 2021
to the GitHub Advisory Database
•
Updated Feb 1, 2023
Description
Published by the National Vulnerability Database
May 20, 2021
Reviewed
May 21, 2021
Published to the GitHub Advisory Database
May 25, 2021
Last updated
Feb 1, 2023
In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1 are vulnerable to Stored Cross-Site Scripting, since the function
validateFormInput()
performs improper validation checks on the input sent to thegroupName
andgroupComment
parameters. Due to this flaw, an authenticated attacker could inject arbitrary script and trick other admin users into downloading malicious files which can cause severe damage to the organization using opennms.References