Medium
Security advisory
In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1 are vulnerable to Stored Cross-Site Scripting, since the function `validateFormInput()` performs improper validation checks on the input sent to the `userID` parameter. Due to this flaw an attacker could inject an arbitrary script which will be stored in the database.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2021-25932
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 12:37 UTC · Revision 1
Source evidence
In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1 are vulnerable to Stored Cross-Site Scripting, since the function `validateFormInput()` performs improper validation checks on the input sent to the `userID` parameter. Due to this flaw an attacker could inject an arbitrary script which will be stored in the database.
osv:CVE-2021-25932
Complete source record
{
"id": "bd74111024fb9fde6a465f1d368f7b418712871327b79c49b85e66ab026021c6",
"url": "https://osv.dev/vulnerability/CVE-2021-25932",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2021-25932",
"summary": "In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1 are vulnerable to Stored Cross-Site Scripting, since the function `validateFormInput()` performs improper validation checks on the input sent to the `userID` parameter. Due to this flaw an attacker could inject an arbitrary script which will be stored in the database.",
"evidence": "osv:CVE-2021-25932",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2021-25932",
"aliases": [
"CVE-2021-25932"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/opennms/opennms",
"type": "GIT",
"events": [
{
"introduced": "9e5617454f5f5d44dcd2fff3a33b603038b52530"
},
{
"last_affected": "131b5855eb8f9faac769718f99b3df890f6cdf34"
},
{
"introduced": "0d3624eadab83197935d675b014fa7d8190e0258"
},
{
"last_affected": "9192675b3a845f997d6ebdb08280328314f7386e"
},
{
"introduced": "67c7635a68963a3005df7aedd41195eb23d9f41b"
},
{
"last_affected": "ffc0c969cd38a879804ee43cab2909afa29c82f5"
},
{
"fixed": "8a97e6869d6e49da18b208c837438ace80049c01"
},
{
"fixed": "eb08b5ed4c5548f3e941a1f0d0363ae4439fa98c"
},
{
"fixed": "f3ebfa3da5352b4d57f238b54c6db315ad99f10e"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:opennms:meridian:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "2015.1.0-1"
},
{
"last_affected": "2019.1.18-1"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:opennms:meridian:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "2020.1.0-1"
},
{
"last_affected": "2020.1.6-1"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:opennms:opennms:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "1.0"
},
{
"last_affected": "27.1.0-1"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "8a97e6869d6e49da18b208c837438ace80049c01"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "eb08b5ed4c5548f3e941a1f0d0363ae4439fa98c"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "f3ebfa3da5352b4d57f238b54c6db315ad99f10e"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"meridian-foundation-2020.1.6-1",
"meridian-foundation-2020.1.5-1",
"meridian-foundation-2020.1.4-1",
"meridian-foundation-2020.1.3-1",
"meridian-foundation-2020.1.2-1",
"meridian-foundation-2020.1.1-1",
"meridian-foundation-2020.1.0-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-25932.json",
"vanir_signatures": [
{
"id": "CVE-2021-25932-04412c6e",
"digest": {
"length": 314,
"function_hash": "144759024573714915384785318319942410353"
},
"source": "https://github.com/opennms/opennms/commit/eb08b5ed4c5548f3e941a1f0d0363ae4439fa98c",
"target": {
"file": "opennms-webapp/src/main/java/org/opennms/web/controller/admin/group/GroupController.java",
"function": "renameGroup"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-25932-26db798a",
"digest": {
"length": 378,
"function_hash": "140896969588649620875571293911303623336"
},
"source": "https://github.com/opennms/opennms/commit/eb08b5ed4c5548f3e941a1f0d0363ae4439fa98c",
"target": {
"file": "opennms-webapp/src/main/java/org/opennms/web/admin/users/RenameUserServlet.java",
"function": "doPost"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-25932-41541a66",
"digest": {
"threshold": 0.9,
"line_hashes": [
"89256397304596016052036103843694799455",
"228142828937052465100599374335507169788",
"253436531422684568205797174898232887867"
]
},
"source": "https://github.com/opennms/opennms/commit/8a97e6869d6e49da18b208c837438ace80049c01",
"target": {
"file": "opennms-webapp/src/main/java/org/opennms/web/admin/users/RenameUserServlet.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2021-25932-42644239",
"digest": {
"threshold": 0.9,
"line_hashes": [
"58730506138354010431660930680209411599",
"131372045428180590852460578241088976601",
"107737349864204963929678012583384325367",
"6897653343869269317735066625920671701",
"220882383980174487142093456676728608479",
"52485355072899409265839311709820086238"
]
},
"source": "https://github.com/opennms/opennms/commit/8a97e6869d6e49da18b208c837438ace80049c01",
"target": {
"file": "opennms-webapp/src/main/java/org/opennms/web/controller/admin/group/GroupController.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2021-25932-68900349",
"digest": {
"threshold": 0.9,
"line_hashes": [
"63862115445021482406981461159020448473",
"192790766046859987790732110517539223001",
"264559957673844931483714759827957494060",
"187562419973017837990659765287661653505"
]
},
"source": "https://github.com/opennms/opennms/commit/8a97e6869d6e49da18b208c837438ace80049c01",
"target": {
"file": "opennms-webapp/src/main/java/org/opennms/web/admin/users/AddNewUserServlet.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2021-25932-756876d8",
"digest": {
"threshold": 0.9,
"line_hashes": [
"63862115445021482406981461159020448473",
"192790766046859987790732110517539223001",
"264559957673844931483714759827957494060",
"187562419973017837990659765287661653505"
]
},
"source": "https://github.com/opennms/opennms/commit/eb08b5ed4c5548f3e941a1f0d0363ae4439fa98c",
"target": {
"file": "opennms-webapp/src/main/java/org/opennms/web/admin/users/AddNewUserServlet.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2021-25932-82a162d6",
"digest": {
"length": 314,
"function_hash": "144759024573714915384785318319942410353"
},
"source": "https://github.com/opennms/opennms/commit/8a97e6869d6e49da18b208c837438ace80049c01",
"target": {
"file": "opennms-webapp/src/main/java/org/opennms/web/controller/admin/group/GroupController.java",
"function": "renameGroup"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-25932-84167b85",
"digest": {
"threshold": 0.9,
"line_hashes": [
"89256397304596016052036103843694799455",
"228142828937052465100599374335507169788",
"253436531422684568205797174898232887867"
]
},
"source": "https://github.com/opennms/opennms/commit/eb08b5ed4c5548f3e941a1f0d0363ae4439fa98c",
"target": {
"file": "opennms-webapp/src/main/java/org/opennms/web/admin/users/RenameUserServlet.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2021-25932-8686c0a9",
"digest": {
"length": 610,
"function_hash": "296653347434168606010481034581794117613"
},
"source": "https://github.com/opennms/opennms/commit/8a97e6869d6e49da18b208c837438ace80049c01",
"target": {
"file": "opennms-webapp/src/main/java/org/opennms/web/controller/admin/group/GroupController.java",
"function": "addGroup"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-25932-b51ae946",
"digest": {
"threshold": 0.9,
"line_hashes": [
"58730506138354010431660930680209411599",
"131372045428180590852460578241088976601",
"107737349864204963929678012583384325367",
"6897653343869269317735066625920671701",
"220882383980174487142093456676728608479",
"52485355072899409265839311709820086238"
]
},
"source": "https://github.com/opennms/opennms/commit/eb08b5ed4c5548f3e941a1f0d0363ae4439fa98c",
"target": {
"file": "opennms-webapp/src/main/java/org/opennms/web/controller/admin/group/GroupController.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2021-25932-b97ea70a",
"digest": {
"length": 1151,
"function_hash": "198479055700301882740520908056306576753"
},
"source": "https://github.com/opennms/opennms/commit/8a97e6869d6e49da18b208c837438ace80049c01",
"target": {
"file": "opennms-webapp/src/main/java/org/opennms/web/admin/users/AddNewUserServlet.java",
"function": "doPost"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-25932-cb44f906",
"digest": {
"length": 610,
"function_hash": "296653347434168606010481034581794117613"
},
"source": "https://github.com/opennms/opennms/commit/eb08b5ed4c5548f3e941a1f0d0363ae4439fa98c",
"target": {
"file": "opennms-webapp/src/main/java/org/opennms/web/controller/admin/group/GroupController.java",
"function": "addGroup"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-25932-d4ce405d",
"digest": {
"threshold": 0.9,
"line_hashes": [
"215985755002245887884707550113681684850",
"11438173654715828717935667960271049116",
"176681594848500904939248140376016076557"
]
},
"source": "https://github.com/opennms/opennms/commit/eb08b5ed4c5548f3e941a1f0d0363ae4439fa98c",
"target": {
"file": "smoke-test/src/test/java/org/opennms/smoketest/UserIT.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2021-25932-eed35066",
"digest": {
"length": 1151,
"function_hash": "198479055700301882740520908056306576753"
},
"source": "https://github.com/opennms/opennms/commit/eb08b5ed4c5548f3e941a1f0d0363ae4439fa98c",
"target": {
"file": "opennms-webapp/src/main/java/org/opennms/web/admin/users/AddNewUserServlet.java",
"function": "doPost"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-25932-f994b4d6",
"digest": {
"length": 378,
"function_hash": "140896969588649620875571293911303623336"
},
"source": "https://github.com/opennms/opennms/commit/8a97e6869d6e49da18b208c837438ace80049c01",
"target": {
"file": "opennms-webapp/src/main/java/org/opennms/web/admin/users/RenameUserServlet.java",
"function": "doPost"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-20T14:02:37Z"
}
}
],
"modified": "2026-10-20T14:02:37.039598563Z",
"provider": "osv",
"references": [
"https://github.com/OpenNMS/opennms/commit/8a97e6869d6e49da18b208c837438ace80049c01",
"https://github.com/OpenNMS/opennms/commit/eb08b5ed4c5548f3e941a1f0d0363ae4439fa98c",
"https://github.com/OpenNMS/opennms/commit/f3ebfa3da5352b4d57f238b54c6db315ad99f10e",
"https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25932"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2021-25932",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 388519,
"published_at": "2021-06-01T12:15:07.787+00:00"
}