OpenNMS version 18.0.1 and prior are vulnerable to a stored XSS issue due to insufficient filtering of SNMP trap supplied data. By creating a malicious SNMP trap, an attacker can store an XSS payload which will trigger when a user of the web UI views the events list page. This issue was fixed in version 18.0.2, released on September 20, 2016.
References
Link | Resource |
---|---|
https://github.com/OpenNMS/opennms/pull/1019 | Patch Third Party Advisory |
https://www.rapid7.com/blog/post/2016/11/15/r7-2016-24-opennms-stored-xss-via-snmp-cve-2016-6555-cve-2016-6556/ | Exploit Third Party Advisory |
Configurations
History
No history.
Information
Published : 2021-09-24 21:15
Updated : 2024-02-28 18:48
NVD link : CVE-2016-6555
Mitre link : CVE-2016-6555
CVE.ORG link : CVE-2016-6555
JSON object : View
Products Affected
opennms
- opennms
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')