CVE-2021-25932

In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through…

published June 1, 2021

CVSS
—
EPSS
1%
Percentile
60.1
In the wild
Unconfirmed
What it is

In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1 are vulnerable to Stored Cross-Site Scripting, since the function `validateFormInput()` performs improper validation checks on the input sent to the `userID` parameter. Due to this flaw an attacker could inject an arbitrary script which will be stored in the database.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00926 · 60.1th percentile
Published
2021-06-01T11:15Z
EPSS history
Timeline
  • 01 JUN 11:15Z
    In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through…
    cvelistv5