Read the docs
TI-2025-33111 Aliases CVE-2025-53121GHSA-cjcp-5fq7-pgm2

Stored XSS in multiple 33.0.8files in opennms/opennms

Priority LOW 30CWE-79Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
Low
User interaction
Active
Attack complexity
Low
Attack requirements
Present
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

Multiple stored XSS were found on different nodes with unsanitized parameters in OpenMNS Horizon 33.0.8 and versions earlier than 33.1.6 on multiple platforms that allow an attacker to store on database and then inject HTML and/or Javascript on the page. The solution is to upgrade to Horizon 33.1.6, 33.1.7 or Meridian 2024.2.6, 2024.2.7 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet. OpenNMS thanks Fábio Tomé for reporting this issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00217 12th percentileScored 2026-11-07
Fix Fixed Horizon (The OpenNMS Group): 33.1.6, 33.1.7Meridian (The OpenNMS Group): 2024.2.6, 2024.2.7

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
The OpenNMS GroupHorizon33.0.8 to before 33.1.6, 33.1.733.1.6, 33.1.7Patch availableCNA
The OpenNMS GroupMeridian2024.1.4 to before 2024.2.6, 2024.2.7; 2023.1.20 to before 2024.2.6, 2024.2.72024.2.6, 2024.2.7Patch availableCNA
  • Horizon VendorThe OpenNMS Group Affected 33.0.8 to before 33.1.6, 33.1.7 Fixed in 33.1.6, 33.1.7 Patch available CNA
  • Meridian VendorThe OpenNMS Group Affected 2024.1.4 to before 2024.2.6, 2024.2.7; 2023.1.20 to before 2024.2.6, 2024.2.7 Fixed in 2024.2.6, 2024.2.7 Patch available CNA

Remediation

  • Fix · CNA Horizon (The OpenNMS Group) Fixed in 33.1.6, 33.1.7
  • Fix · CNA Meridian (The OpenNMS Group) Fixed in 2024.2.6, 2024.2.7

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    The OpenNMS Group Meridian 2024.2.6, 2024.2.7

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2025-33112 SQLi in OpenNMS Horizon and MeridianPriority LOW 30
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-53121
  2. 2026-10-03 Alias added: GHSA-cjcp-5fq7-pgm2

References

Other 2

  • TI-2021-07941 Cross-site request forgery in OpenNMS CVSS 3.1HIGH 8.8
  • TI-2021-07943 Cross-site scripting in OpenNMS CVSS 3.1MEDIUM 4.8
  • TI-2021-07939 Cross-site scripting in OpenNMS CVSS 3.1MEDIUM 4.8
  • TI-2021-07940 Cross-site request forgery in OpenNMS CVSS 3.1MEDIUM 4.3
  • TI-2015-06530 OpenNMS has a default password of rtc for the rtc account, which makes it easier for… CVSS 2.0HIGH 10.0
  • TI-2026-74978 OpenNMS REST authorization bypass via non-canonical HTTP method CVSS 3.1CRITICAL 9.1
See all 38 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences