CVE-2016-6555

OpenNMS version 18.0.1 and prior are vulnerable to a stored XSS issue due to insufficient filtering of SNMP trap supplied data. By creating a malicious SNMP trap, an attacker can store an XSS payload which will trigger when a user of the web UI views the events list page. This issue was fixed in version 18.0.2, released on September 20, 2016.
Configurations

Configuration 1 (hide)

cpe:2.3:a:opennms:opennms:*:*:*:*:*:*:*:*

History

21 Nov 2024, 02:56

Type Values Removed Values Added
References () https://github.com/OpenNMS/opennms/pull/1019 - Patch, Third Party Advisory () https://github.com/OpenNMS/opennms/pull/1019 - Patch, Third Party Advisory
References () https://www.rapid7.com/blog/post/2016/11/15/r7-2016-24-opennms-stored-xss-via-snmp-cve-2016-6555-cve-2016-6556/ - Exploit, Third Party Advisory () https://www.rapid7.com/blog/post/2016/11/15/r7-2016-24-opennms-stored-xss-via-snmp-cve-2016-6555-cve-2016-6556/ - Exploit, Third Party Advisory
CVSS v2 : 4.3
v3 : 6.1
v2 : 4.3
v3 : 7.1

Information

Published : 2021-09-24 21:15

Updated : 2024-11-21 02:56


NVD link : CVE-2016-6555

Mitre link : CVE-2016-6555

CVE.ORG link : CVE-2016-6555


JSON object : View

Products Affected

opennms

  • opennms
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')