Vulnerability Details CVE-2021-25929
In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1 are vulnerable to Stored Cross-Site Scripting since there is no validation on the input being sent to the `name` parameter in `noticeWizard` endpoint. Due to this flaw an authenticated attacker could inject arbitrary script and trick other admin users into downloading malicious files.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.003
EPSS Ranking 55.4%
CVSS Severity
CVSS v3 Score 4.8
CVSS v2 Score 3.5
Products affected by CVE-2021-25929
-
cpe:2.3:a:opennms:horizon:1.0
-
cpe:2.3:a:opennms:horizon:16.0.0
-
cpe:2.3:a:opennms:horizon:17.0.0
-
cpe:2.3:a:opennms:horizon:17.1.0
-
cpe:2.3:a:opennms:horizon:17.1.1
-
cpe:2.3:a:opennms:horizon:18.0.0
-
cpe:2.3:a:opennms:horizon:18.0.1
-
cpe:2.3:a:opennms:horizon:18.0.2
-
cpe:2.3:a:opennms:horizon:18.0.3
-
cpe:2.3:a:opennms:horizon:18.0.4
-
cpe:2.3:a:opennms:horizon:19.0.0
-
cpe:2.3:a:opennms:horizon:19.0.1
-
cpe:2.3:a:opennms:horizon:19.1.0
-
cpe:2.3:a:opennms:horizon:20.0.0
-
cpe:2.3:a:opennms:horizon:20.0.1
-
cpe:2.3:a:opennms:horizon:20.0.2
-
cpe:2.3:a:opennms:horizon:20.1.0
-
cpe:2.3:a:opennms:horizon:21.0.0
-
cpe:2.3:a:opennms:horizon:21.0.1
-
cpe:2.3:a:opennms:horizon:21.0.2
-
cpe:2.3:a:opennms:horizon:21.0.3
-
cpe:2.3:a:opennms:horizon:21.0.4
-
cpe:2.3:a:opennms:horizon:21.0.5
-
cpe:2.3:a:opennms:horizon:21.1.0
-
cpe:2.3:a:opennms:horizon:22.0.0
-
cpe:2.3:a:opennms:horizon:22.0.1
-
cpe:2.3:a:opennms:horizon:22.0.2
-
cpe:2.3:a:opennms:horizon:22.0.3
-
cpe:2.3:a:opennms:horizon:22.0.4
-
cpe:2.3:a:opennms:horizon:23.0.0
-
cpe:2.3:a:opennms:horizon:23.0.1
-
cpe:2.3:a:opennms:horizon:23.0.2
-
cpe:2.3:a:opennms:horizon:23.0.3
-
cpe:2.3:a:opennms:horizon:23.0.4
-
cpe:2.3:a:opennms:horizon:24.0.0
-
cpe:2.3:a:opennms:horizon:24.1.0
-
cpe:2.3:a:opennms:horizon:24.1.1
-
cpe:2.3:a:opennms:horizon:24.1.2
-
cpe:2.3:a:opennms:horizon:24.1.3
-
cpe:2.3:a:opennms:horizon:25.0.0
-
cpe:2.3:a:opennms:horizon:25.1.0
-
cpe:2.3:a:opennms:horizon:25.1.1
-
cpe:2.3:a:opennms:horizon:25.1.2
-
cpe:2.3:a:opennms:horizon:25.2.0
-
cpe:2.3:a:opennms:horizon:25.2.1
-
cpe:2.3:a:opennms:horizon:26.0.0
-
cpe:2.3:a:opennms:horizon:26.0.1
-
cpe:2.3:a:opennms:horizon:26.1.0
-
cpe:2.3:a:opennms:horizon:26.1.1
-
cpe:2.3:a:opennms:horizon:26.1.2
-
cpe:2.3:a:opennms:horizon:26.1.3
-
cpe:2.3:a:opennms:horizon:26.2.0
-
cpe:2.3:a:opennms:horizon:26.2.1
-
cpe:2.3:a:opennms:horizon:26.2.2
-
cpe:2.3:a:opennms:horizon:27.0.0
-
cpe:2.3:a:opennms:horizon:27.0.1
-
cpe:2.3:a:opennms:horizon:27.0.2
-
cpe:2.3:a:opennms:horizon:27.0.3
-
cpe:2.3:a:opennms:horizon:27.0.4
-
cpe:2.3:a:opennms:horizon:27.0.5
-
cpe:2.3:a:opennms:horizon:27.1.0
-
cpe:2.3:a:opennms:meridian:2015.1.0
-
cpe:2.3:a:opennms:meridian:2015.1.0-1
-
cpe:2.3:a:opennms:meridian:2015.1.1-1
-
cpe:2.3:a:opennms:meridian:2015.1.10-1
-
cpe:2.3:a:opennms:meridian:2015.1.2-1
-
cpe:2.3:a:opennms:meridian:2015.1.3-1
-
cpe:2.3:a:opennms:meridian:2015.1.4-1
-
cpe:2.3:a:opennms:meridian:2015.1.5-1
-
cpe:2.3:a:opennms:meridian:2015.1.6-1
-
cpe:2.3:a:opennms:meridian:2015.1.7-1
-
cpe:2.3:a:opennms:meridian:2015.1.8-1
-
cpe:2.3:a:opennms:meridian:2015.1.9-1
-
cpe:2.3:a:opennms:meridian:2016.1.0
-
cpe:2.3:a:opennms:meridian:2016.1.1-1
-
cpe:2.3:a:opennms:meridian:2016.1.10-1
-
cpe:2.3:a:opennms:meridian:2016.1.11-1
-
cpe:2.3:a:opennms:meridian:2016.1.12-1
-
cpe:2.3:a:opennms:meridian:2016.1.13-1
-
cpe:2.3:a:opennms:meridian:2016.1.14-1
-
cpe:2.3:a:opennms:meridian:2016.1.15-1
-
cpe:2.3:a:opennms:meridian:2016.1.16-1
-
cpe:2.3:a:opennms:meridian:2016.1.17-1
-
cpe:2.3:a:opennms:meridian:2016.1.18-1
-
cpe:2.3:a:opennms:meridian:2016.1.19-1
-
cpe:2.3:a:opennms:meridian:2016.1.2-1
-
cpe:2.3:a:opennms:meridian:2016.1.20
-
cpe:2.3:a:opennms:meridian:2016.1.20-1
-
cpe:2.3:a:opennms:meridian:2016.1.21
-
cpe:2.3:a:opennms:meridian:2016.1.21-1
-
cpe:2.3:a:opennms:meridian:2016.1.22
-
cpe:2.3:a:opennms:meridian:2016.1.22-1
-
cpe:2.3:a:opennms:meridian:2016.1.23
-
cpe:2.3:a:opennms:meridian:2016.1.23-1
-
cpe:2.3:a:opennms:meridian:2016.1.24
-
cpe:2.3:a:opennms:meridian:2016.1.24-1
-
cpe:2.3:a:opennms:meridian:2016.1.3-1
-
cpe:2.3:a:opennms:meridian:2016.1.4-1
-
cpe:2.3:a:opennms:meridian:2016.1.5-1
-
cpe:2.3:a:opennms:meridian:2016.1.6-1
-
cpe:2.3:a:opennms:meridian:2016.1.7-1
-
cpe:2.3:a:opennms:meridian:2016.1.8-1
-
cpe:2.3:a:opennms:meridian:2016.1.9-1
-
cpe:2.3:a:opennms:meridian:2017
-
cpe:2.3:a:opennms:meridian:2017.1.0
-
cpe:2.3:a:opennms:meridian:2017.1.0-1
-
cpe:2.3:a:opennms:meridian:2017.1.1
-
cpe:2.3:a:opennms:meridian:2017.1.1-1
-
cpe:2.3:a:opennms:meridian:2017.1.10
-
cpe:2.3:a:opennms:meridian:2017.1.10-1
-
cpe:2.3:a:opennms:meridian:2017.1.11
-
cpe:2.3:a:opennms:meridian:2017.1.11-1
-
cpe:2.3:a:opennms:meridian:2017.1.12
-
cpe:2.3:a:opennms:meridian:2017.1.12-1
-
cpe:2.3:a:opennms:meridian:2017.1.13
-
cpe:2.3:a:opennms:meridian:2017.1.13-1
-
cpe:2.3:a:opennms:meridian:2017.1.14
-
cpe:2.3:a:opennms:meridian:2017.1.14-1
-
cpe:2.3:a:opennms:meridian:2017.1.15
-
cpe:2.3:a:opennms:meridian:2017.1.15-1
-
cpe:2.3:a:opennms:meridian:2017.1.16
-
cpe:2.3:a:opennms:meridian:2017.1.16-1
-
cpe:2.3:a:opennms:meridian:2017.1.17
-
cpe:2.3:a:opennms:meridian:2017.1.17-1
-
cpe:2.3:a:opennms:meridian:2017.1.18
-
cpe:2.3:a:opennms:meridian:2017.1.18-1
-
cpe:2.3:a:opennms:meridian:2017.1.19
-
cpe:2.3:a:opennms:meridian:2017.1.19-1
-
cpe:2.3:a:opennms:meridian:2017.1.2
-
cpe:2.3:a:opennms:meridian:2017.1.2-1
-
cpe:2.3:a:opennms:meridian:2017.1.20
-
cpe:2.3:a:opennms:meridian:2017.1.20-1
-
cpe:2.3:a:opennms:meridian:2017.1.21
-
cpe:2.3:a:opennms:meridian:2017.1.21-1
-
cpe:2.3:a:opennms:meridian:2017.1.22
-
cpe:2.3:a:opennms:meridian:2017.1.22-1
-
cpe:2.3:a:opennms:meridian:2017.1.23
-
cpe:2.3:a:opennms:meridian:2017.1.23-1
-
cpe:2.3:a:opennms:meridian:2017.1.24
-
cpe:2.3:a:opennms:meridian:2017.1.24-1
-
cpe:2.3:a:opennms:meridian:2017.1.25
-
cpe:2.3:a:opennms:meridian:2017.1.25-1
-
cpe:2.3:a:opennms:meridian:2017.1.26
-
cpe:2.3:a:opennms:meridian:2017.1.26-1
-
cpe:2.3:a:opennms:meridian:2017.1.3
-
cpe:2.3:a:opennms:meridian:2017.1.3-1
-
cpe:2.3:a:opennms:meridian:2017.1.4
-
cpe:2.3:a:opennms:meridian:2017.1.4-1
-
cpe:2.3:a:opennms:meridian:2017.1.5
-
cpe:2.3:a:opennms:meridian:2017.1.5-1
-
cpe:2.3:a:opennms:meridian:2017.1.6
-
cpe:2.3:a:opennms:meridian:2017.1.6-1
-
cpe:2.3:a:opennms:meridian:2017.1.7
-
cpe:2.3:a:opennms:meridian:2017.1.7-1
-
cpe:2.3:a:opennms:meridian:2017.1.8
-
cpe:2.3:a:opennms:meridian:2017.1.8-1
-
cpe:2.3:a:opennms:meridian:2017.1.9
-
cpe:2.3:a:opennms:meridian:2017.1.9-1
-
cpe:2.3:a:opennms:meridian:2018
-
cpe:2.3:a:opennms:meridian:2018.1.0
-
cpe:2.3:a:opennms:meridian:2018.1.0-1
-
cpe:2.3:a:opennms:meridian:2018.1.1
-
cpe:2.3:a:opennms:meridian:2018.1.1-1
-
cpe:2.3:a:opennms:meridian:2018.1.10
-
cpe:2.3:a:opennms:meridian:2018.1.10-1
-
cpe:2.3:a:opennms:meridian:2018.1.11
-
cpe:2.3:a:opennms:meridian:2018.1.11-1
-
cpe:2.3:a:opennms:meridian:2018.1.12
-
cpe:2.3:a:opennms:meridian:2018.1.12-1
-
cpe:2.3:a:opennms:meridian:2018.1.13
-
cpe:2.3:a:opennms:meridian:2018.1.13-1
-
cpe:2.3:a:opennms:meridian:2018.1.14
-
cpe:2.3:a:opennms:meridian:2018.1.14-1
-
cpe:2.3:a:opennms:meridian:2018.1.15
-
cpe:2.3:a:opennms:meridian:2018.1.15-1
-
cpe:2.3:a:opennms:meridian:2018.1.16
-
cpe:2.3:a:opennms:meridian:2018.1.16-1
-
cpe:2.3:a:opennms:meridian:2018.1.17
-
cpe:2.3:a:opennms:meridian:2018.1.17-1
-
cpe:2.3:a:opennms:meridian:2018.1.18
-
cpe:2.3:a:opennms:meridian:2018.1.18-1
-
cpe:2.3:a:opennms:meridian:2018.1.19
-
cpe:2.3:a:opennms:meridian:2018.1.19-1
-
cpe:2.3:a:opennms:meridian:2018.1.2
-
cpe:2.3:a:opennms:meridian:2018.1.2-1
-
cpe:2.3:a:opennms:meridian:2018.1.20
-
cpe:2.3:a:opennms:meridian:2018.1.20-1
-
cpe:2.3:a:opennms:meridian:2018.1.21
-
cpe:2.3:a:opennms:meridian:2018.1.21-1
-
cpe:2.3:a:opennms:meridian:2018.1.22
-
cpe:2.3:a:opennms:meridian:2018.1.22-1
-
cpe:2.3:a:opennms:meridian:2018.1.23
-
cpe:2.3:a:opennms:meridian:2018.1.23-1
-
cpe:2.3:a:opennms:meridian:2018.1.24
-
cpe:2.3:a:opennms:meridian:2018.1.24-1
-
cpe:2.3:a:opennms:meridian:2018.1.25
-
cpe:2.3:a:opennms:meridian:2018.1.25-1
-
cpe:2.3:a:opennms:meridian:2018.1.26
-
cpe:2.3:a:opennms:meridian:2018.1.26-1
-
cpe:2.3:a:opennms:meridian:2018.1.27
-
cpe:2.3:a:opennms:meridian:2018.1.27-1
-
cpe:2.3:a:opennms:meridian:2018.1.28
-
cpe:2.3:a:opennms:meridian:2018.1.28-1
-
cpe:2.3:a:opennms:meridian:2018.1.29
-
cpe:2.3:a:opennms:meridian:2018.1.29-1
-
cpe:2.3:a:opennms:meridian:2018.1.3
-
cpe:2.3:a:opennms:meridian:2018.1.3-1
-
cpe:2.3:a:opennms:meridian:2018.1.30
-
cpe:2.3:a:opennms:meridian:2018.1.31
-
cpe:2.3:a:opennms:meridian:2018.1.4
-
cpe:2.3:a:opennms:meridian:2018.1.4-1
-
cpe:2.3:a:opennms:meridian:2018.1.5
-
cpe:2.3:a:opennms:meridian:2018.1.5-1
-
cpe:2.3:a:opennms:meridian:2018.1.6
-
cpe:2.3:a:opennms:meridian:2018.1.6-1
-
cpe:2.3:a:opennms:meridian:2018.1.7
-
cpe:2.3:a:opennms:meridian:2018.1.7-1
-
cpe:2.3:a:opennms:meridian:2018.1.8
-
cpe:2.3:a:opennms:meridian:2018.1.8-1
-
cpe:2.3:a:opennms:meridian:2018.1.9
-
cpe:2.3:a:opennms:meridian:2018.1.9-1
-
cpe:2.3:a:opennms:meridian:2019
-
cpe:2.3:a:opennms:meridian:2019.1.0
-
cpe:2.3:a:opennms:meridian:2019.1.0-1
-
cpe:2.3:a:opennms:meridian:2019.1.1
-
cpe:2.3:a:opennms:meridian:2019.1.1-1
-
cpe:2.3:a:opennms:meridian:2019.1.10
-
cpe:2.3:a:opennms:meridian:2019.1.10-1
-
cpe:2.3:a:opennms:meridian:2019.1.11
-
cpe:2.3:a:opennms:meridian:2019.1.11-1
-
cpe:2.3:a:opennms:meridian:2019.1.12
-
cpe:2.3:a:opennms:meridian:2019.1.12-1
-
cpe:2.3:a:opennms:meridian:2019.1.13
-
cpe:2.3:a:opennms:meridian:2019.1.13-1
-
cpe:2.3:a:opennms:meridian:2019.1.14
-
cpe:2.3:a:opennms:meridian:2019.1.14-1
-
cpe:2.3:a:opennms:meridian:2019.1.15
-
cpe:2.3:a:opennms:meridian:2019.1.15-1
-
cpe:2.3:a:opennms:meridian:2019.1.16
-
cpe:2.3:a:opennms:meridian:2019.1.16-1
-
cpe:2.3:a:opennms:meridian:2019.1.17
-
cpe:2.3:a:opennms:meridian:2019.1.17-1
-
cpe:2.3:a:opennms:meridian:2019.1.18
-
cpe:2.3:a:opennms:meridian:2019.1.18-1
-
cpe:2.3:a:opennms:meridian:2019.1.2
-
cpe:2.3:a:opennms:meridian:2019.1.2-1
-
cpe:2.3:a:opennms:meridian:2019.1.3
-
cpe:2.3:a:opennms:meridian:2019.1.3-1
-
cpe:2.3:a:opennms:meridian:2019.1.4
-
cpe:2.3:a:opennms:meridian:2019.1.4-1
-
cpe:2.3:a:opennms:meridian:2019.1.5
-
cpe:2.3:a:opennms:meridian:2019.1.5-1
-
cpe:2.3:a:opennms:meridian:2019.1.6
-
cpe:2.3:a:opennms:meridian:2019.1.6-1
-
cpe:2.3:a:opennms:meridian:2019.1.7
-
cpe:2.3:a:opennms:meridian:2019.1.7-1
-
cpe:2.3:a:opennms:meridian:2019.1.8
-
cpe:2.3:a:opennms:meridian:2019.1.8-1
-
cpe:2.3:a:opennms:meridian:2019.1.9
-
cpe:2.3:a:opennms:meridian:2020.1.0
-
cpe:2.3:a:opennms:meridian:2020.1.1
-
cpe:2.3:a:opennms:meridian:2020.1.1-1
-
cpe:2.3:a:opennms:meridian:2020.1.2
-
cpe:2.3:a:opennms:meridian:2020.1.2-1
-
cpe:2.3:a:opennms:meridian:2020.1.3
-
cpe:2.3:a:opennms:meridian:2020.1.3-1
-
cpe:2.3:a:opennms:meridian:2020.1.4
-
cpe:2.3:a:opennms:meridian:2020.1.4-1
-
cpe:2.3:a:opennms:meridian:2020.1.5
-
cpe:2.3:a:opennms:meridian:2020.1.5-1
-
cpe:2.3:a:opennms:meridian:2020.1.6