Details
-
Bug
-
Status: Resolved (View Workflow)
-
Major
-
Resolution: Fixed
-
27.1.0, Meridian-2020.1.7
-
Security Level: Default (Default Security Scheme)
-
Horizon 2021 - Mar 31 - Apr 14, Horizon 2021 - Apr 14 - Apr 28, Horizon 2021 - Apr 28 - May 12
-
Backlog CM
Description
The reporter of this vulnerability prefers to remain anonymous.
A reflected cross-site scripting (XSS) vulnerability exists in the OpenNMS webapp, and can be exploited by any actor with the ability to search for events in the webapp. I have verified that it is exploitable in Horizon 27.1.0.
Steps to reproduce:
- Log in as a normal, non-admin user
- Open Status -> Events
- In the "Event ID" box, enter <script>alert("XSS")</script> and submit the form
Expected result: Input validation neutralizes the attempted exploit, as already happens when searching for alarms and notifications
Actual result: Alert popup observed in empty search results page