OpenNMS up to 1.5.93 filter cross site scripting

Summaryinfo

A vulnerability, which was classified as problematic, was found in OpenNMS. Affected by this vulnerability is an unknown functionality. Executing a manipulation of the argument filter can lead to cross site scripting. This vulnerability is tracked as CVE-2008-4320. The attack can be launched remotely. Moreover, an exploit is present. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in OpenNMS. It has been declared as problematic. This vulnerability affects some unknown functionality. The manipulation of the argument filter with an unknown input leads to a cross site scripting vulnerability. The CWE definition for the vulnerability is CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. As an impact it is known to affect integrity. CVE summarizes:

Multiple cross-site scripting (XSS) vulnerabilities in OpenNMS before 1.5.94 allow remote attackers to inject arbitrary web script or HTML via (1) the j_username parameter to j_acegi_security_check, (2) the username parameter to notification/list.jsp, and (3) the filter parameter to event/list.

The weakness was disclosed 09/29/2008 (Website). The advisory is available at securityfocus.com. This vulnerability was named CVE-2008-4320 since 09/29/2008. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Successful exploitation requires user interaction by the victim. Technical details and also a public exploit are known. This vulnerability is assigned to T1059.007 by the MITRE ATT&CK project.

It is possible to download the exploit at exploit-db.com. It is declared as highly functional.

Upgrading to version 1.2.0 eliminates this vulnerability.

The vulnerability is also documented in the databases at X-Force (45417), Exploit-DB (32425), SecurityFocus (BID 31410†) and Secunia (SA32019†). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Name

• OpenNMS

Version

• 1.0.0
• 1.1.0
• 1.1.1
• 1.1.2
• 1.1.3
• 1.1.4
• 1.1.5
• 1.2.0
• 1.2.1
• 1.2.2
• 1.2.3
• 1.2.4
• 1.3.0
• 1.3.1
• 1.3.2
• 1.3.3
• 1.3.4
• 1.3.5
• 1.3.6
• 1.3.7
• 1.3.8
• 1.3.9
• 1.3.10
• 1.3.11
• 1.5.90
• 1.5.91
• 1.5.92
• 1.5.93

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion