CVE-2021-25935: XSS
First published: Tue May 25 2021(Updated: )
In OpenNMS Horizon, versions opennms-17.0.0-1 through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.7-1 are vulnerable to Stored Cross-Site Scripting, since the function `add()` performs improper validation checks on the input sent to the `foreign-source` parameter. Due to this flaw an attacker could bypass the existing regex validation and inject an arbitrary script which will be stored in the database.
Credit: vulnerabilitylab@mend.io
| Affected Software | Affected Version | How to fix |
|---|---|---|
| OpenNMS Horizon | >=17.0.0<=27.1.0 | |
| OpenNMS Meridian | >=2015.1.0<=2019.1.18 | |
| OpenNMS Meridian | >=2020.1.0<=2020.1.7 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2021-25935?
The severity of CVE-2021-25935 is medium with a severity value of 5.4.
Which versions of OpenNMS Horizon are affected by CVE-2021-25935?
OpenNMS Horizon versions opennms-17.0.0-1 through opennms-27.1.0-1 are affected by CVE-2021-25935.
Which versions of OpenNMS Meridian are affected by CVE-2021-25935?
OpenNMS Meridian versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1 and meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.7-1 are affected by CVE-2021-25935.
What is the vulnerability of CVE-2021-25935?
CVE-2021-25935 is a Stored Cross-Site Scripting vulnerability.
How can I fix CVE-2021-25935?
To fix CVE-2021-25935, update OpenNMS Horizon to version opennms-27.1.0-1 or later, or update OpenNMS Meridian to version meridian-foundation-2019.1.18-1 or later for meridian-foundation-2015.1.0-1 through meridian-foundation-2020.1.7-1.
- collector/nvd-index
- agent/type
- agent/remedy
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/last-modified-date
- agent/severity
- agent/references
- agent/author
- agent/description
- agent/first-publish-date
- agent/event
- agent/tags
- vendor/opennms
- canonical/opennms horizon
- version/opennms horizon/17.0.0
- version/opennms horizon/27.1.0
- canonical/opennms meridian
- version/opennms meridian/2015.1.0
- version/opennms meridian/2019.1.18
- version/opennms meridian/2020.1.0
- version/opennms meridian/2020.1.7