Описание
In OpenNMS Horizon, versions opennms-18.0.0-1 through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.7-1 are vulnerable to Stored Cross-Site Scripting, since the function createRequisitionedNode() does not perform any validation checks on the input sent to the node-label parameter. Due to this flaw an attacker could inject an arbitrary script which will be stored in the database.
Ссылки
- PatchThird Party Advisory
- PatchThird Party Advisory
- ExploitThird Party Advisory
- PatchThird Party Advisory
- PatchThird Party Advisory
- ExploitThird Party Advisory
Уязвимые конфигурации
Конфигурация 1Версия от 18.0.0 (включая) до 27.1.0 (включая)Версия от 2015.1.0 (включая) до 2019.1.18 (включая)Версия от 2020.1.0 (включая) до 2020.1.7 (включая)
Одно из
cpe:2.3:a:opennms:horizon:*:*:*:*:*:*:*:*
cpe:2.3:a:opennms:meridian:*:*:*:*:*:*:*:*
cpe:2.3:a:opennms:meridian:*:*:*:*:*:*:*:*
EPSS
Процентиль: 51%
0.00284
Низкий
5.4 Medium
CVSS3
3.5 Low
CVSS2
Дефекты
CWE-79
Связанные уязвимости
CVSS3: 5.4
debian
больше 4 лет назад
In OpenNMS Horizon, versions opennms-18.0.0-1 through opennms-27.1.0-1 ...
EPSS
Процентиль: 51%
0.00284
Низкий
5.4 Medium
CVSS3
3.5 Low
CVSS2
Дефекты
CWE-79