Medium
Security advisory
In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1 are vulnerable to Stored Cross-Site Scripting since there is no validation on the input being sent to the `name` parameter in `noticeWizard` endpoint. Due to this flaw an authenticated attacker could inject arbitrary script and trick other admin users into downloading malicious files.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2021-25929
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 12:42 UTC · Revision 1
Source evidence
In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1 are vulnerable to Stored Cross-Site Scripting since there is no validation on the input being sent to the `name` parameter in `noticeWizard` endpoint. Due to this flaw an authenticated attacker could inject arbitrary script and trick other admin users into downloading malicious files.
osv:CVE-2021-25929
Complete source record
{
"id": "c5e1b77cfde9c6e1402b689f9bdf2e40895d6c4ea2c0a0d81a27191b636574b2",
"url": "https://osv.dev/vulnerability/CVE-2021-25929",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2021-25929",
"summary": "In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1 are vulnerable to Stored Cross-Site Scripting since there is no validation on the input being sent to the `name` parameter in `noticeWizard` endpoint. Due to this flaw an authenticated attacker could inject arbitrary script and trick other admin users into downloading malicious files.",
"evidence": "osv:CVE-2021-25929",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2021-25929",
"aliases": [
"CVE-2021-25929",
"GHSA-jmv4-73v2-pvgc"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/opennms/opennms",
"type": "GIT",
"events": [
{
"introduced": "67c7635a68963a3005df7aedd41195eb23d9f41b"
},
{
"fixed": "399ed865e66ec3cb60674c3e7ec8403309754dfb"
},
{
"introduced": "9e5617454f5f5d44dcd2fff3a33b603038b52530"
},
{
"fixed": "bfd3de5ac0f158e2e1a257d0ee30291281334e60"
},
{
"introduced": "0d3624eadab83197935d675b014fa7d8190e0258"
},
{
"fixed": "4ad904678528a4f8e26ae3e776b1009f6564be2e"
},
{
"fixed": "66c1f626bf38a7d1a9530b4d68598269ee5245a2"
},
{
"fixed": "eb08b5ed4c5548f3e941a1f0d0363ae4439fa98c"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:opennms:horizon:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "1.0"
},
{
"fixed": "27.1.1"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:opennms:meridian:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "2015.1.0"
},
{
"fixed": "2019.1.19"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:opennms:meridian:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "2020.1.0"
},
{
"fixed": "2020.1.7"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "66c1f626bf38a7d1a9530b4d68598269ee5245a2"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "eb08b5ed4c5548f3e941a1f0d0363ae4439fa98c"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"meridian-foundation-2020.1.6-1",
"meridian-foundation-2020.1.5-1",
"meridian-foundation-2020.1.4-1",
"meridian-foundation-2020.1.3-1",
"meridian-foundation-2020.1.2-1",
"meridian-foundation-2020.1.1-1",
"meridian-foundation-2020.1.0-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-25929.json",
"vanir_signatures": [
{
"id": "CVE-2021-25929-025f01ec",
"digest": {
"threshold": 0.9,
"line_hashes": [
"274512322503962685663647942214031473657",
"239957005078604087605198069636665484125",
"51297086796185311165292000712741592405",
"89316630911645056401425776591707967796"
]
},
"source": "https://github.com/opennms/opennms/commit/399ed865e66ec3cb60674c3e7ec8403309754dfb",
"target": {
"file": "opennms-full-assembly/src/test/java/org/opennms/assemblies/karaf/OnmsKarafTestCase.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2021-25929-04412c6e",
"digest": {
"length": 314,
"function_hash": "144759024573714915384785318319942410353"
},
"source": "https://github.com/opennms/opennms/commit/eb08b5ed4c5548f3e941a1f0d0363ae4439fa98c",
"target": {
"file": "opennms-webapp/src/main/java/org/opennms/web/controller/admin/group/GroupController.java",
"function": "renameGroup"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-25929-26db798a",
"digest": {
"length": 378,
"function_hash": "140896969588649620875571293911303623336"
},
"source": "https://github.com/opennms/opennms/commit/eb08b5ed4c5548f3e941a1f0d0363ae4439fa98c",
"target": {
"file": "opennms-webapp/src/main/java/org/opennms/web/admin/users/RenameUserServlet.java",
"function": "doPost"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-25929-756876d8",
"digest": {
"threshold": 0.9,
"line_hashes": [
"63862115445021482406981461159020448473",
"192790766046859987790732110517539223001",
"264559957673844931483714759827957494060",
"187562419973017837990659765287661653505"
]
},
"source": "https://github.com/opennms/opennms/commit/eb08b5ed4c5548f3e941a1f0d0363ae4439fa98c",
"target": {
"file": "opennms-webapp/src/main/java/org/opennms/web/admin/users/AddNewUserServlet.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2021-25929-84167b85",
"digest": {
"threshold": 0.9,
"line_hashes": [
"89256397304596016052036103843694799455",
"228142828937052465100599374335507169788",
"253436531422684568205797174898232887867"
]
},
"source": "https://github.com/opennms/opennms/commit/eb08b5ed4c5548f3e941a1f0d0363ae4439fa98c",
"target": {
"file": "opennms-webapp/src/main/java/org/opennms/web/admin/users/RenameUserServlet.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2021-25929-8629809b",
"digest": {
"length": 185,
"function_hash": "131658155818715672810866632343923060109"
},
"source": "https://github.com/opennms/opennms/commit/399ed865e66ec3cb60674c3e7ec8403309754dfb",
"target": {
"file": "opennms-full-assembly/src/test/java/org/opennms/assemblies/karaf/OnmsKarafTestCase.java",
"function": "getFrameworkUrl"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-25929-b51ae946",
"digest": {
"threshold": 0.9,
"line_hashes": [
"58730506138354010431660930680209411599",
"131372045428180590852460578241088976601",
"107737349864204963929678012583384325367",
"6897653343869269317735066625920671701",
"220882383980174487142093456676728608479",
"52485355072899409265839311709820086238"
]
},
"source": "https://github.com/opennms/opennms/commit/eb08b5ed4c5548f3e941a1f0d0363ae4439fa98c",
"target": {
"file": "opennms-webapp/src/main/java/org/opennms/web/controller/admin/group/GroupController.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2021-25929-cb44f906",
"digest": {
"length": 610,
"function_hash": "296653347434168606010481034581794117613"
},
"source": "https://github.com/opennms/opennms/commit/eb08b5ed4c5548f3e941a1f0d0363ae4439fa98c",
"target": {
"file": "opennms-webapp/src/main/java/org/opennms/web/controller/admin/group/GroupController.java",
"function": "addGroup"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-25929-d4ce405d",
"digest": {
"threshold": 0.9,
"line_hashes": [
"215985755002245887884707550113681684850",
"11438173654715828717935667960271049116",
"176681594848500904939248140376016076557"
]
},
"source": "https://github.com/opennms/opennms/commit/eb08b5ed4c5548f3e941a1f0d0363ae4439fa98c",
"target": {
"file": "smoke-test/src/test/java/org/opennms/smoketest/UserIT.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2021-25929-eed35066",
"digest": {
"length": 1151,
"function_hash": "198479055700301882740520908056306576753"
},
"source": "https://github.com/opennms/opennms/commit/eb08b5ed4c5548f3e941a1f0d0363ae4439fa98c",
"target": {
"file": "opennms-webapp/src/main/java/org/opennms/web/admin/users/AddNewUserServlet.java",
"function": "doPost"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-20T14:17:23Z"
}
}
],
"modified": "2026-10-20T14:17:23.693518462Z",
"provider": "osv",
"references": [
"https://github.com/OpenNMS/opennms/commit/66c1f626bf38a7d1a9530b4d68598269ee5245a2",
"https://github.com/OpenNMS/opennms/commit/eb08b5ed4c5548f3e941a1f0d0363ae4439fa98c",
"https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25929"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2021-25929",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 388782,
"published_at": "2021-05-20T15:15:07.603+00:00"
}