CVE-2021-25933 : Security Advisory and Response

OpenNMS Horizon and OpenNMS Meridian versions are vulnerable to Stored Cross-Site Scripting due to improper validation checks in the

validateFormInput()

function. This flaw could allow an authenticated attacker to inject malicious scripts.

Understanding CVE-2021-25933

This CVE identifies a Stored Cross-Site Scripting vulnerability in OpenNMS Horizon and OpenNMS Meridian.

What is CVE-2021-25933?

In OpenNMS Horizon and OpenNMS Meridian, a flaw in the

validateFormInput()

function allows an authenticated attacker to perform Stored Cross-Site Scripting attacks by injecting arbitrary scripts.

The Impact of CVE-2021-25933

The vulnerability could be exploited by attackers to trick admin users into executing malicious scripts, potentially leading to severe damage within organizations using OpenNMS.

Technical Details of CVE-2021-25933

This section covers specific technical details regarding the vulnerability.

Vulnerability Description

The flaw arises from improper validation checks on the

groupName

and

groupComment

parameters in the

validateFormInput()

function.

Affected Systems and Versions

OpenNMS Horizon versions opennms-1-0-stable through opennms-27.1.0-1 and OpenNMS Meridian versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1 and meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1 are affected by this vulnerability.

Exploitation Mechanism

An authenticated attacker can exploit this vulnerability by injecting arbitrary scripts into the affected parameters, potentially leading to Stored Cross-Site Scripting attacks.

Mitigation and Prevention

Learn how to address and prevent the CVE-2021-25933 vulnerability.

Immediate Steps to Take

Upgrade OpenNMS Horizon and OpenNMS Meridian to non-vulnerable versions.
Implement input validation mechanisms to sanitize user inputs.

Long-Term Security Practices

Conduct regular security audits and code reviews.
Keep systems up to date with the latest security patches.

Patching and Updates

Refer to the provided references for patches and updates to mitigate the vulnerability.