TI-2021-07943 Aliases CVE-2021-25933 GHSA-jjhw-5mxp-2g2q

Cross-site scripting in OpenNMS

MEDIUM 55CWE-79Published 2021-05-20 · Updated 2025-04-30

Key facts

Attack vector: Network
Privileges required: High
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1 are vulnerable to Stored Cross-Site Scripting, since the function `validateFormInput()` performs improper validation checks on the input sent to the `groupName` and `groupComment` parameters. Due to this flaw, an authenticated attacker could inject arbitrary script and trick other admin users into downloading malicious files which can cause severe damage to the organization using opennms.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.01043 64th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed org.opennms:opennms (Maven): 27.1.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	OpenNMS	opennms-1-0-stable,opennms-1.0.1 through opennms-27.1.0-1,meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1,meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1	—	No fix listed	CNA
—	org.opennms:opennms (Maven)	1.0.0 to before 27.1.1	27.1.1	Patch available	GHSA-jjhw-5mxp-2g2q

OpenNMS Vendor— Affected opennms-1-0-stable,opennms-1.0.1 through opennms-27.1.0-1,meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1,meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1 Fixed in — No fix listed CNA
org.opennms:opennms (Maven) Vendor— Affected 1.0.0 to before 27.1.1 Fixed in 27.1.1 Patch available GHSA-jjhw-5mxp-2g2q

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:opennms:horizon::::::::	1.0 to before 27.1.1	Vulnerable	The OpenNMS Group
cpe:2.3:a:opennms:meridian::::::::	2015.1.0 to before 2019.1.19; 2020.1.0 to before 2020.1.7	Vulnerable	The OpenNMS Group

cpe:2.3:a:opennms:horizon:*:*:*:*:*:*:*:* Versions 1.0 to before 27.1.1 Vulnerable ·The OpenNMS Group
cpe:2.3:a:opennms:meridian:*:*:*:*:*:*:*:* Versions 2015.1.0 to before 2019.1.19; 2020.1.0 to before 2020.1.7 Vulnerable ·The OpenNMS Group

Remediation

Fix · GHSA-jjhw-5mxp-2g2q org.opennms:opennms (Maven) Fixed in 27.1.1 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2021-25933
2026-10-03 Alias added: GHSA-jjhw-5mxp-2g2q

References

Exploit 1

https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25933

Patch 2

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2021-25933

Other 3

TI-2021-07941 Cross-site request forgery in OpenNMS CVSS 3.1HIGH 8.8
TI-2021-07939 Cross-site scripting in OpenNMS CVSS 3.1MEDIUM 4.8
TI-2021-07940 Cross-site request forgery in OpenNMS CVSS 3.1MEDIUM 4.3
TI-2021-02366 OpenNMS Meridian 2016, 2017, 2018 before 2018.1.25, 2019 before 2019.1.16, and 2020… CVSS 3.1HIGH 8.8
TI-2023-00827 ROLE_REST can be used to escalate to ROLE_ADMIN via /rest/users CVSS 3.1HIGH 8.2
TI-2023-21153 Disable BeanShell Interpreter Remote Server Mode CVSS 3.1HIGH 8.8

See all 21 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences