CVSS: 5.4EPSS: 0%CPEs: 3EXPL: 1CVE-2021-25932
https://notcve.org/view.php?id=CVE-2021-25932
In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1 are vulnerable to Stored Cross-Site Scripting, since the function `validateFormInput()` performs improper validation checks on the input sent to the `userID` parameter. Due to this flaw an attacker could inject an arbitrary script which will be stored in the database. En OpenNMS Horizon, versiones opennms-1-0-stable hasta opennms-27.1.0-1; OpenNMS Meridian, versiones meridian-foundation-2015.1.0-1 hasta meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 hasta meridian-foundation-2020.1.6-1 son vulnerables a ataques de tipo Cross-Site Scripting almacenados, ya que la función "validateFormInput()" realiza comprobaciones de comprobación incorrectas en la entrada enviada al parámetro "userID" . Debido a este fallo, un atacante podría inyectar un script arbitrario que se almacenará en la base de datos • https://github.com/OpenNMS/opennms/commit/8a97e6869d6e49da18b208c837438ace80049c01 https://github.com/OpenNMS/opennms/commit/eb08b5ed4c5548f3e941a1f0d0363ae4439fa98c https://github.com/OpenNMS/opennms/commit/f3ebfa3da5352b4d57f238b54c6db315ad99f10e https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25932 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2020-12760
https://notcve.org/view.php?id=CVE-2020-12760
An issue was discovered in OpenNMS Horizon before 26.0.1, and Meridian before 2018.1.19 and 2019 before 2019.1.7. The ActiveMQ channel configuration allowed for arbitrary deserialization of Java objects (aka ActiveMQ Minion payload deserialization), leading to remote code execution for any authenticated channel user regardless of its assigned permissions. Se detectó un problema en OpenNMS Horizon versiones anteriores a 26.0.1 y Meridian versiones anteriores a 2018.1.19 y versiones 2019 anteriores a 2019.1.7. La configuración del canal ActiveMQ permitió la deserialización arbitraria de objetos Java (también se conoce cmo deserialización de la carga útil de ActiveMQ Minion), conllevando a una ejecución de código remota para cualquier usuario del canal autenticado, sin importar sus permisos asignados. • https://github.com/OpenNMS/opennms/releases/tag/opennms-26.0.1-1 https://issues.opennms.org/browse/NMS-12673 https://www.opennms.com/en/blog/2020-04-29-opennms-horizon-26-0-1-luchador-released https://www.opennms.com/en/blog/2020-04-29-opennms-meridian-2018-1-18-wildfire-released https://www.opennms.com/en/blog/2020-04-29-opennms-meridian-2019-1-6-europa-released • CWE-502: Deserialization of Untrusted Data •