TI-2021-07939 Aliases CVE-2021-25929 GHSA-jmv4-73v2-pvgc

Cross-site scripting in OpenNMS

MEDIUM 55CWE-79Published 2021-05-20 · Updated 2025-04-30

Key facts

Attack vector: Network
Privileges required: High
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1 are vulnerable to Stored Cross-Site Scripting since there is no validation on the input being sent to the `name` parameter in `noticeWizard` endpoint. Due to this flaw an authenticated attacker could inject arbitrary script and trick other admin users into downloading malicious files.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.0102 63rd percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed org.opennms:opennms (Maven): 27.1.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	OpenNMS	opennms-1-0-stable,opennms-1.0.1 through opennms-27.1.0-1,meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1,meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1	—	No fix listed	CNA
—	org.opennms:opennms (Maven)	1.0.0 to before 27.1.1	27.1.1	Patch available	GHSA-jmv4-73v2-pvgc

OpenNMS Vendor— Affected opennms-1-0-stable,opennms-1.0.1 through opennms-27.1.0-1,meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1,meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1 Fixed in — No fix listed CNA
org.opennms:opennms (Maven) Vendor— Affected 1.0.0 to before 27.1.1 Fixed in 27.1.1 Patch available GHSA-jmv4-73v2-pvgc

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:opennms:horizon::::::::	1.0 to before 27.1.1	Vulnerable	The OpenNMS Group
cpe:2.3:a:opennms:meridian::::::::	2015.1.0 to before 2019.1.19; 2020.1.0 to before 2020.1.7	Vulnerable	The OpenNMS Group

cpe:2.3:a:opennms:horizon:*:*:*:*:*:*:*:* Versions 1.0 to before 27.1.1 Vulnerable ·The OpenNMS Group
cpe:2.3:a:opennms:meridian:*:*:*:*:*:*:*:* Versions 2015.1.0 to before 2019.1.19; 2020.1.0 to before 2020.1.7 Vulnerable ·The OpenNMS Group

Remediation

Fix · GHSA-jmv4-73v2-pvgc org.opennms:opennms (Maven) Fixed in 27.1.1 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2021-25929
2026-10-03 Alias added: GHSA-jmv4-73v2-pvgc

References

Exploit 1

https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25929

Patch 2

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2021-25929

Other 1

https://github.com/OpenNMS/opennms

TI-2021-07941 Cross-site request forgery in OpenNMS CVSS 3.1HIGH 8.8
TI-2021-07943 Cross-site scripting in OpenNMS CVSS 3.1MEDIUM 4.8
TI-2021-07940 Cross-site request forgery in OpenNMS CVSS 3.1MEDIUM 4.3
TI-2021-02366 OpenNMS Meridian 2016, 2017, 2018 before 2018.1.25, 2019 before 2019.1.16, and 2020… CVSS 3.1HIGH 8.8
TI-2023-00827 ROLE_REST can be used to escalate to ROLE_ADMIN via /rest/users CVSS 3.1HIGH 8.2
TI-2023-21153 Disable BeanShell Interpreter Remote Server Mode CVSS 3.1HIGH 8.8

See all 21 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences