CVE-2021-25934

In OpenNMS Horizon, versions opennms-18.0.0-1 through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.7-1 are vulnerable to Stored Cross-Site Scripting, since the function `createRequisitionedNode()` does not perform any validation checks on the input sent to the `node-label` parameter. Due to this flaw an attacker could inject an arbitrary script which will be stored in the database.
Advertisement

NeevaHost hosting service

Configurations

Configuration 1 (hide)

OR cpe:2.3:a:opennms:horizon:*:*:*:*:*:*:*:*
cpe:2.3:a:opennms:meridian:*:*:*:*:*:*:*:*
cpe:2.3:a:opennms:meridian:*:*:*:*:*:*:*:*

Information

Published : 2021-05-25 12:15

Updated : 2021-06-03 08:24


NVD link : CVE-2021-25934

Mitre link : CVE-2021-25934


JSON object : View

CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Advertisement

dedicated server usa

Products Affected

opennms

  • horizon
  • meridian