CVE-2008-4320: XSS
Published Sep 29, 2008
·Updated
Multiple cross-site scripting (XSS) vulnerabilities in OpenNMS before 1.5.94 allow remote attackers to inject arbitrary web script or HTML via (1) the jusername parameter to jacegisecuritycheck, (2) the username parameter to notification/list.jsp, and (3) the filter parameter to event/list.
Affected Software
28 affected components
Opennms.org Opennms=1.1.1
Opennms.org Opennms=1.3.5
Opennms.org Opennms<=1.2.0
Opennms.org Opennms=1.1.3
Opennms.org Opennms=1.3.4
Opennms.org Opennms=1.3.9
Opennms.org Opennms=1.3.6
Opennms.org Opennms=1.5.91
Opennms.org Opennms=1.2.2
Opennms.org Opennms=1.2.4
Opennms.org Opennms=1.5.92
Opennms.org Opennms=1.1.5
Opennms.org Opennms=1.3.3
Opennms.org Opennms<=1.1.0
Opennms.org Opennms<=1.0.0
Opennms.org Opennms=1.3.10
Opennms.org Opennms=1.2.1
Opennms.org Opennms=1.1.2
Opennms.org Opennms=1.3.11
Opennms.org Opennms=1.3.1
Opennms.org Opennms<=1.5.90
Opennms.org Opennms<=1.3.0
Opennms.org Opennms=1.5.93
Opennms.org Opennms=1.3.7
Opennms.org Opennms=1.2.3
Opennms.org Opennms=1.3.2
Opennms.org Opennms=1.3.8
Opennms.org Opennms=1.1.4
Remediation
Patch Available
Event History
Sep 29, 2008
CVE Published
via MITRE·06:00 PM
Data Sourced
via MITRE·06:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2008-4320?
CVE-2008-4320 has been classified as a medium severity vulnerability.
2
How do I fix CVE-2008-4320?
To fix CVE-2008-4320, upgrade OpenNMS to version 1.5.94 or later.
3
Which versions of OpenNMS are affected by CVE-2008-4320?
OpenNMS versions prior to 1.5.94, including 1.1.1 through 1.5.93, are affected by CVE-2008-4320.
4
What type of vulnerability is CVE-2008-4320?
CVE-2008-4320 is a cross-site scripting (XSS) vulnerability.
5
What are the potential impacts of CVE-2008-4320?
CVE-2008-4320 allows remote attackers to inject arbitrary web scripts or HTML, which could lead to session hijacking or defacement.