CVE-2021-25934

In OpenNMS Horizon, versions opennms-18.0.0-1 through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through…

published May 25, 2021

CVSS
—
EPSS
1%
Percentile
62.7
In the wild
Unconfirmed
What it is

In OpenNMS Horizon, versions opennms-18.0.0-1 through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.7-1 are vulnerable to Stored Cross-Site Scripting, since the function `createRequisitionedNode()` does not perform any validation checks on the input sent to the `node-label` parameter. Due to this flaw an attacker could inject an arbitrary script which will be stored in the database.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01008 · 62.7th percentile
Published
2021-05-25T18:42Z
EPSS history
Timeline
  • 25 MAY 18:42Z
    In OpenNMS Horizon, versions opennms-18.0.0-1 through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through…
    cvelistv5