TI-2021-07944 Aliases CVE-2021-25934 GHSA-9hhc-cc6c-99hh

Cross-site scripting in OpenNMS

LOW 26CWE-79Published 2021-05-25 · Updated 2024-08-03

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

In OpenNMS Horizon, versions opennms-18.0.0-1 through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.7-1 are vulnerable to Stored Cross-Site Scripting, since the function `createRequisitionedNode()` does not perform any validation checks on the input sent to the `node-label` parameter. Due to this flaw an attacker could inject an arbitrary script which will be stored in the database.

Why it matters now

EPSS 0.01008 63rd percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	OpenNMS	opennms-18.0.0-1 through opennms-27.1.0-1,meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1,meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.7-1	—	No fix listed	CNA
—	org.opennms:opennms (Maven)	18.0.0-1 – 27.1.0-1	—	No fix listed	GHSA-9hhc-cc6c-99hh

OpenNMS Vendor— Affected opennms-18.0.0-1 through opennms-27.1.0-1,meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1,meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.7-1 Fixed in — No fix listed CNA
org.opennms:opennms (Maven) Vendor— Affected 18.0.0-1 – 27.1.0-1 Fixed in — No fix listed GHSA-9hhc-cc6c-99hh

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:opennms:horizon::::::::	18.0.0 – 27.1.0	Vulnerable	The OpenNMS Group
cpe:2.3:a:opennms:meridian::::::::	2015.1.0 – 2019.1.18; 2020.1.0 – 2020.1.7	Vulnerable	The OpenNMS Group

cpe:2.3:a:opennms:horizon:*:*:*:*:*:*:*:* Versions 18.0.0 – 27.1.0 Vulnerable ·The OpenNMS Group
cpe:2.3:a:opennms:meridian:*:*:*:*:*:*:*:* Versions 2015.1.0 – 2019.1.18; 2020.1.0 – 2020.1.7 Vulnerable ·The OpenNMS Group

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2021-25934
2026-10-03 Alias added: GHSA-9hhc-cc6c-99hh

References

Exploit 1

https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25934

Patch 2

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2021-25934

TI-2021-07941 Cross-site request forgery in OpenNMS CVSS 3.1HIGH 8.8
TI-2021-07943 Cross-site scripting in OpenNMS CVSS 3.1MEDIUM 4.8
TI-2021-07939 Cross-site scripting in OpenNMS CVSS 3.1MEDIUM 4.8
TI-2021-07940 Cross-site request forgery in OpenNMS CVSS 3.1MEDIUM 4.3
TI-2021-02366 OpenNMS Meridian 2016, 2017, 2018 before 2018.1.25, 2019 before 2019.1.16, and 2020… CVSS 3.1HIGH 8.8
TI-2023-00827 ROLE_REST can be used to escalate to ROLE_ADMIN via /rest/users CVSS 3.1HIGH 8.2

See all 21 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences