CVE-2021-25932

Опубликовано: 01 июн. 2021

Источник: nvd

CVSS3: 5.4

CVSS2: 3.5

EPSS Низкий

Описание

In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1 are vulnerable to Stored Cross-Site Scripting, since the function validateFormInput() performs improper validation checks on the input sent to the userID parameter. Due to this flaw an attacker could inject an arbitrary script which will be stored in the database.

Ссылки

https://github.com/OpenNMS/opennms/commit/8a97e6869d6e49da18b208c837438ace80049c01
Patch
Third Party Advisory
https://github.com/OpenNMS/opennms/commit/eb08b5ed4c5548f3e941a1f0d0363ae4439fa98c
Patch
Third Party Advisory
https://github.com/OpenNMS/opennms/commit/f3ebfa3da5352b4d57f238b54c6db315ad99f10e
Patch
Third Party Advisory
https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25932
Exploit
Third Party Advisory
https://github.com/OpenNMS/opennms/commit/8a97e6869d6e49da18b208c837438ace80049c01
Patch
Third Party Advisory
https://github.com/OpenNMS/opennms/commit/eb08b5ed4c5548f3e941a1f0d0363ae4439fa98c
Patch
Third Party Advisory
https://github.com/OpenNMS/opennms/commit/f3ebfa3da5352b4d57f238b54c6db315ad99f10e
Patch
Third Party Advisory
https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25932
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:opennms:meridian:*:*:*:*:*:*:*:*

Версия от 2015.1.0-1 (включая) до 2019.1.18-1 (включая)

cpe:2.3:a:opennms:meridian:*:*:*:*:*:*:*:*

Версия от 2020.1.0-1 (включая) до 2020.1.6-1 (включая)

cpe:2.3:a:opennms:opennms:*:*:*:*:*:*:*:*

Версия от 1.0 (включая) до 27.1.0-1 (включая)

EPSS

Процентиль: 50%

0.00264

Низкий

5.4 Medium

CVSS3

3.5 Low

CVSS2

Дефекты

CWE-79

Связанные уязвимости

CVE-2021-25932

CVSS3: 5.4

debian

больше 4 лет назад

In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0 ...

GHSA-78gg-3865-6f24

github

больше 3 лет назад

In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1 are vulnerable to Stored Cross-Site Scripting, since the function `validateFormInput()` performs improper validation checks on the input sent to the `userID` parameter. Due to this flaw an attacker could inject an arbitrary script which will be stored in the database.