CVE-2021-25934

In OpenNMS Horizon, versions opennms-18.0.0-1 through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.7-1 are vulnerable to Stored Cross-Site Scripting, since the function `createRequisitionedNode()` does not perform any validation checks on the input sent to the `node-label` parameter. Due to this flaw an attacker could inject an arbitrary script which will be stored in the database.

CVSS v3.1

5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CVSS v2.0

3.5 LOWAV:N/AC:M/Au:S/C:N/I:P/A:N

EPSS

1.01% chance of exploitation in the next 30 days, 61th percentile

Published

2021-05-25

Updated

2024-08-03

Proof-of-concept exploits (1)

• https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25934

References

• CVE Record
• NVD entry

Related

• CVE-2021-25933
• CVE-2021-25935
• CVE-2021-25932
• CVE-2021-25938
• CVE-2021-25931
• CVE-2021-25939