CVE-2008-4320 Multiple cross-site scripting (XSS) vulnerabilities in OpenNMS before 1.5.94 allow remote attackers to inject arbitrary web script or HTML via (1) the j_username parameter to j_acegi_security_check, (...
MediumCVSS 4.3
EPSS 1.9%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Multiple cross-site scripting (XSS) vulnerabilities in OpenNMS before 1.5.94 allow remote attackers to inject arbitrary web script or HTML via (1) the j_username parameter to j_acegi_security_check, (2) the username parameter to notification/list.jsp, and (3) the filter parameter to event/list.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| opennms.org opennms | <= 1.0.0 | No fix listed |
| opennms.org opennms | <= 1.1.0 | No fix listed |
| opennms.org opennms | <= 1.2.0 | No fix listed |
| opennms.org opennms | <= 1.3.0 | No fix listed |
| opennms.org opennms | <= 1.5.90 | No fix listed |
| opennms.org opennms | = 1.1.1 | No fix listed |
| opennms.org opennms | = 1.1.2 | No fix listed |
| opennms.org opennms | = 1.1.3 | No fix listed |
| opennms.org opennms | = 1.1.4 | No fix listed |
| opennms.org opennms | = 1.1.5 | No fix listed |
| opennms.org opennms | = 1.2.1 | No fix listed |
| opennms.org opennms | = 1.2.2 | No fix listed |
| opennms.org opennms | = 1.2.3 | No fix listed |
| opennms.org opennms | = 1.2.4 | No fix listed |
| opennms.org opennms | = 1.3.1 | No fix listed |
| opennms.org opennms | = 1.3.2 | No fix listed |
| opennms.org opennms | = 1.3.3 | No fix listed |
| opennms.org opennms | = 1.3.4 | No fix listed |
| opennms.org opennms | = 1.3.5 | No fix listed |
| opennms.org opennms | = 1.3.6 | No fix listed |
| opennms.org opennms | = 1.3.7 | No fix listed |
| opennms.org opennms | = 1.3.8 | No fix listed |
| opennms.org opennms | = 1.3.9 | No fix listed |
| opennms.org opennms | = 1.3.10 | No fix listed |
| opennms.org opennms | = 1.3.11 | No fix listed |
Show 3 more
| Product | Affected versions | Fixed in |
|---|---|---|
| opennms.org opennms | = 1.5.91 | No fix listed |
| opennms.org opennms | = 1.5.92 | No fix listed |
| opennms.org opennms | = 1.5.93 | No fix listed |
References
- bugzilla.opennms.org exploit
- bugzilla.opennms.org exploit
- bugzilla.opennms.org exploit
- 32019 third-party-advisory vendor-advisory
- www.opennms.org patch
- 31410 exploit patch vdb-entry
- opennms-jacegisecuritycheck-xss(45417) vdb-entry