Medium
Security advisory
In OpenNMS Horizon, versions opennms-17.0.0-1 through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.7-1 are vulnerable to Stored Cross-Site Scripting, since the function `add()` performs improper validation checks on the input sent to the `foreign-source` parameter. Due to this flaw an attacker could bypass the existing regex validation and inject an arbitrary script which will be stored in the database.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2021-25935
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 12:42 UTC · Revision 1
Source evidence
In OpenNMS Horizon, versions opennms-17.0.0-1 through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.7-1 are vulnerable to Stored Cross-Site Scripting, since the function `add()` performs improper validation checks on the input sent to the `foreign-source` parameter. Due to this flaw an attacker could bypass the existing regex validation and inject an arbitrary script which will be stored in the database.
osv:CVE-2021-25935
Complete source record
{
"id": "791023bbf98c0dcb76d1d6bc52e6f799237393edff7501bcfdfaa2de62888f20",
"url": "https://osv.dev/vulnerability/CVE-2021-25935",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2021-25935",
"summary": "In OpenNMS Horizon, versions opennms-17.0.0-1 through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.7-1 are vulnerable to Stored Cross-Site Scripting, since the function `add()` performs improper validation checks on the input sent to the `foreign-source` parameter. Due to this flaw an attacker could bypass the existing regex validation and inject an arbitrary script which will be stored in the database.",
"evidence": "osv:CVE-2021-25935",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2021-25935",
"aliases": [
"CVE-2021-25935"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/opennms/opennms",
"type": "GIT",
"events": [
{
"introduced": "7220f205d1f6ffd6b96a7878de2ae23e3faae3ad"
},
{
"last_affected": "ffc0c969cd38a879804ee43cab2909afa29c82f5"
},
{
"introduced": "9e5617454f5f5d44dcd2fff3a33b603038b52530"
},
{
"last_affected": "131b5855eb8f9faac769718f99b3df890f6cdf34"
},
{
"introduced": "0d3624eadab83197935d675b014fa7d8190e0258"
},
{
"last_affected": "4ad904678528a4f8e26ae3e776b1009f6564be2e"
},
{
"fixed": "101e3aa06ec9a1f8f266335fc6f5685c062c6117"
},
{
"fixed": "eb08b5ed4c5548f3e941a1f0d0363ae4439fa98c"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:opennms:horizon:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "17.0.0"
},
{
"last_affected": "27.1.0"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:opennms:meridian:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "2015.1.0"
},
{
"last_affected": "2019.1.18"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:opennms:meridian:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "2020.1.0"
},
{
"last_affected": "2020.1.7"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "101e3aa06ec9a1f8f266335fc6f5685c062c6117"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "eb08b5ed4c5548f3e941a1f0d0363ae4439fa98c"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"meridian-foundation-2020.1.7-1",
"meridian-foundation-2020.1.6-1",
"meridian-foundation-2020.1.5-1",
"meridian-foundation-2020.1.4-1",
"meridian-foundation-2020.1.3-1",
"meridian-foundation-2020.1.2-1",
"meridian-foundation-2020.1.1-1",
"meridian-foundation-2020.1.0-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-25935.json",
"vanir_signatures": [
{
"id": "CVE-2021-25935-04412c6e",
"digest": {
"length": 314,
"function_hash": "144759024573714915384785318319942410353"
},
"source": "https://github.com/opennms/opennms/commit/eb08b5ed4c5548f3e941a1f0d0363ae4439fa98c",
"target": {
"file": "opennms-webapp/src/main/java/org/opennms/web/controller/admin/group/GroupController.java",
"function": "renameGroup"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-25935-26db798a",
"digest": {
"length": 378,
"function_hash": "140896969588649620875571293911303623336"
},
"source": "https://github.com/opennms/opennms/commit/eb08b5ed4c5548f3e941a1f0d0363ae4439fa98c",
"target": {
"file": "opennms-webapp/src/main/java/org/opennms/web/admin/users/RenameUserServlet.java",
"function": "doPost"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-25935-756876d8",
"digest": {
"threshold": 0.9,
"line_hashes": [
"63862115445021482406981461159020448473",
"192790766046859987790732110517539223001",
"264559957673844931483714759827957494060",
"187562419973017837990659765287661653505"
]
},
"source": "https://github.com/opennms/opennms/commit/eb08b5ed4c5548f3e941a1f0d0363ae4439fa98c",
"target": {
"file": "opennms-webapp/src/main/java/org/opennms/web/admin/users/AddNewUserServlet.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2021-25935-84167b85",
"digest": {
"threshold": 0.9,
"line_hashes": [
"89256397304596016052036103843694799455",
"228142828937052465100599374335507169788",
"253436531422684568205797174898232887867"
]
},
"source": "https://github.com/opennms/opennms/commit/eb08b5ed4c5548f3e941a1f0d0363ae4439fa98c",
"target": {
"file": "opennms-webapp/src/main/java/org/opennms/web/admin/users/RenameUserServlet.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2021-25935-b51ae946",
"digest": {
"threshold": 0.9,
"line_hashes": [
"58730506138354010431660930680209411599",
"131372045428180590852460578241088976601",
"107737349864204963929678012583384325367",
"6897653343869269317735066625920671701",
"220882383980174487142093456676728608479",
"52485355072899409265839311709820086238"
]
},
"source": "https://github.com/opennms/opennms/commit/eb08b5ed4c5548f3e941a1f0d0363ae4439fa98c",
"target": {
"file": "opennms-webapp/src/main/java/org/opennms/web/controller/admin/group/GroupController.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2021-25935-cb44f906",
"digest": {
"length": 610,
"function_hash": "296653347434168606010481034581794117613"
},
"source": "https://github.com/opennms/opennms/commit/eb08b5ed4c5548f3e941a1f0d0363ae4439fa98c",
"target": {
"file": "opennms-webapp/src/main/java/org/opennms/web/controller/admin/group/GroupController.java",
"function": "addGroup"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-25935-d4ce405d",
"digest": {
"threshold": 0.9,
"line_hashes": [
"215985755002245887884707550113681684850",
"11438173654715828717935667960271049116",
"176681594848500904939248140376016076557"
]
},
"source": "https://github.com/opennms/opennms/commit/eb08b5ed4c5548f3e941a1f0d0363ae4439fa98c",
"target": {
"file": "smoke-test/src/test/java/org/opennms/smoketest/UserIT.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2021-25935-eed35066",
"digest": {
"length": 1151,
"function_hash": "198479055700301882740520908056306576753"
},
"source": "https://github.com/opennms/opennms/commit/eb08b5ed4c5548f3e941a1f0d0363ae4439fa98c",
"target": {
"file": "opennms-webapp/src/main/java/org/opennms/web/admin/users/AddNewUserServlet.java",
"function": "doPost"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-20T14:17:22Z"
}
}
],
"modified": "2026-10-20T14:17:22.919874627Z",
"provider": "osv",
"references": [
"https://github.com/OpenNMS/opennms/commit/101e3aa06ec9a1f8f266335fc6f5685c062c6117",
"https://github.com/OpenNMS/opennms/commit/eb08b5ed4c5548f3e941a1f0d0363ae4439fa98c",
"https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25935"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2021-25935",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 388780,
"published_at": "2021-05-25T19:15:07.657+00:00"
}