Vulnerability · Published May 25, 2021 · Assigned by Mend

CVE-2021-25935

Medium 5.4

In plain English

A medium-severity security flaw in OpenNMS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 60% of all known vulnerabilities).

Severity (CVSS NVD)5.4Medium

Exploit odds (30 days)0.9%top 39.8% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

In OpenNMS Horizon, versions opennms-17.0.0-1 through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.7-1 are vulnerable to Stored Cross-Site Scripting, since the function `add()` performs improper validation checks on the input sent to the `foreign-source` parameter. Due to this flaw an attacker could bypass the existing regex validation and inject an arbitrary script which will be stored in the database.

Affected products (as reported)

Vendor	Product	Versions
n/a	OpenNMS	opennms-17.0.0-1 through opennms-27.1.0-1,meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1,meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.7-1

References

https://github.com/OpenNMS/opennms/commit/eb08b5ed4c5548f3e941a1f0d0363ae4439fa98c x_refsource_MISC
https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25935 x_refsource_MISC
https://github.com/OpenNMS/opennms/commit/101e3aa06ec9a1f8f266335fc6f5685c062c6117 x_refsource_MISC