{"id":"CVE-2021-25935","details":"In OpenNMS Horizon, versions opennms-17.0.0-1 through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.7-1 are vulnerable to Stored Cross-Site Scripting, since the function `add()` performs improper validation checks on the input sent to the `foreign-source` parameter. Due to this flaw an attacker could bypass the existing regex validation and inject an arbitrary script which will be stored in the database.","modified":"2026-07-09T01:30:21.074523Z","published":"2021-05-25T19:15:07.657Z","references":[{"type":"FIX","url":"https://github.com/OpenNMS/opennms/commit/101e3aa06ec9a1f8f266335fc6f5685c062c6117"},{"type":"FIX","url":"https://github.com/OpenNMS/opennms/commit/eb08b5ed4c5548f3e941a1f0d0363ae4439fa98c"},{"type":"EVIDENCE","url":"https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25935"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/opennms/opennms","events":[{"introduced":"7220f205d1f6ffd6b96a7878de2ae23e3faae3ad"},{"last_affected":"ffc0c969cd38a879804ee43cab2909afa29c82f5"},{"introduced":"9e5617454f5f5d44dcd2fff3a33b603038b52530"},{"last_affected":"131b5855eb8f9faac769718f99b3df890f6cdf34"},{"introduced":"0d3624eadab83197935d675b014fa7d8190e0258"},{"last_affected":"4ad904678528a4f8e26ae3e776b1009f6564be2e"},{"fixed":"101e3aa06ec9a1f8f266335fc6f5685c062c6117"},{"fixed":"eb08b5ed4c5548f3e941a1f0d0363ae4439fa98c"}],"database_specific":{"cpe":["cpe:2.3:a:opennms:horizon:*:*:*:*:*:*:*:*","cpe:2.3:a:opennms:meridian:*:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"17.0.0"},{"last_affected":"27.1.0"},{"introduced":"2015.1.0"},{"last_affected":"2019.1.18"},{"introduced":"2020.1.0"},{"last_affected":"2020.1.7"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["meridian-foundation-2020.1.7-1","meridian-foundation-2020.1.6-1","meridian-foundation-2020.1.5-1","meridian-foundation-2020.1.4-1","meridian-foundation-2020.1.3-1","meridian-foundation-2020.1.2-1","meridian-foundation-2020.1.1-1","meridian-foundation-2020.1.0-1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-25935.json","vanir_signatures_modified":"2026-07-09T01:30:21Z","vanir_signatures":[{"target":{"file":"opennms-webapp/src/main/java/org/opennms/web/controller/admin/group/GroupController.java","function":"renameGroup"},"deprecated":false,"digest":{"function_hash":"144759024573714915384785318319942410353","length":314},"id":"CVE-2021-25935-04412c6e","signature_type":"Function","signature_version":"v1","source":"https://github.com/opennms/opennms/commit/eb08b5ed4c5548f3e941a1f0d0363ae4439fa98c"},{"signature_version":"v1","source":"https://github.com/opennms/opennms/commit/eb08b5ed4c5548f3e941a1f0d0363ae4439fa98c","target":{"file":"opennms-webapp/src/main/java/org/opennms/web/admin/users/RenameUserServlet.java","function":"doPost"},"deprecated":false,"digest":{"function_hash":"140896969588649620875571293911303623336","length":378},"id":"CVE-2021-25935-26db798a","signature_type":"Function"},{"signature_version":"v1","source":"https://github.com/opennms/opennms/commit/eb08b5ed4c5548f3e941a1f0d0363ae4439fa98c","target":{"file":"opennms-webapp/src/main/java/org/opennms/web/admin/users/AddNewUserServlet.java"},"deprecated":false,"digest":{"line_hashes":["63862115445021482406981461159020448473","192790766046859987790732110517539223001","264559957673844931483714759827957494060","187562419973017837990659765287661653505"],"threshold":0.9},"id":"CVE-2021-25935-756876d8","signature_type":"Line"},{"id":"CVE-2021-25935-84167b85","signature_type":"Line","signature_version":"v1","source":"https://github.com/opennms/opennms/commit/eb08b5ed4c5548f3e941a1f0d0363ae4439fa98c","target":{"file":"opennms-webapp/src/main/java/org/opennms/web/admin/users/RenameUserServlet.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["89256397304596016052036103843694799455","228142828937052465100599374335507169788","253436531422684568205797174898232887867"]}},{"signature_version":"v1","source":"https://github.com/opennms/opennms/commit/eb08b5ed4c5548f3e941a1f0d0363ae4439fa98c","target":{"file":"opennms-webapp/src/main/java/org/opennms/web/controller/admin/group/GroupController.java"},"deprecated":false,"digest":{"line_hashes":["58730506138354010431660930680209411599","131372045428180590852460578241088976601","107737349864204963929678012583384325367","6897653343869269317735066625920671701","220882383980174487142093456676728608479","52485355072899409265839311709820086238"],"threshold":0.9},"id":"CVE-2021-25935-b51ae946","signature_type":"Line"},{"digest":{"function_hash":"296653347434168606010481034581794117613","length":610},"id":"CVE-2021-25935-cb44f906","signature_type":"Function","signature_version":"v1","source":"https://github.com/opennms/opennms/commit/eb08b5ed4c5548f3e941a1f0d0363ae4439fa98c","target":{"file":"opennms-webapp/src/main/java/org/opennms/web/controller/admin/group/GroupController.java","function":"addGroup"},"deprecated":false},{"target":{"file":"smoke-test/src/test/java/org/opennms/smoketest/UserIT.java"},"deprecated":false,"digest":{"line_hashes":["215985755002245887884707550113681684850","11438173654715828717935667960271049116","176681594848500904939248140376016076557"],"threshold":0.9},"id":"CVE-2021-25935-d4ce405d","signature_type":"Line","signature_version":"v1","source":"https://github.com/opennms/opennms/commit/eb08b5ed4c5548f3e941a1f0d0363ae4439fa98c"},{"id":"CVE-2021-25935-eed35066","signature_type":"Function","signature_version":"v1","source":"https://github.com/opennms/opennms/commit/eb08b5ed4c5548f3e941a1f0d0363ae4439fa98c","target":{"file":"opennms-webapp/src/main/java/org/opennms/web/admin/users/AddNewUserServlet.java","function":"doPost"},"deprecated":false,"digest":{"function_hash":"198479055700301882740520908056306576753","length":1151}}]}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"}]}