CVE-2021-25929: Cross-site Scripting in OpenNMS Horizon
Summary
CVE-2021-25929: Cross-site Scripting in OpenNMS Horizon. Affects org.opennms:opennms versions >= 1.0.0, < 27.1.1. Fixed in 27.1.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenNMS Horizon is an open-source network management platform that provides monitoring and management capabilities for network devices and services. It is built using the Maven ecosystem and is widely used by organizations to monitor their network infrastructure. However, versions opennms-1-0-stable through opennms-27.1.1 of OpenNMS Horizon are vulnerable to a stored cross-site scripting (XSS) vulnerability.
Vulnerability Detail
The vulnerability arises due to the lack of input validation on the name parameter in the noticeWizard endpoint. An authenticated attacker can exploit this flaw to inject arbitrary scripts into the application, potentially leading to the execution of malicious code. This can be particularly dangerous as it allows the attacker to trick other admin users into downloading and executing malicious files.
How To Fix
Latest published version: 31.0.3 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
27.1.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. It is crucial to apply the fix by upgrading to a patched version of OpenNMS Horizon.
Conclusion
In conclusion, OpenNMS Horizon versions opennms-1-0-stable through opennms-27.1.1 are vulnerable to a stored cross-site scripting (XSS) vulnerability. This can be exploited by an authenticated attacker to inject arbitrary scripts and trick other admin users into executing malicious code. It is crucial to upgrade to a fixed version, such as 27.1.1, to mitigate the risk of exploitation. For further assistance, please contact DevNack.com.
See every vulnerability recorded for org.opennms:opennms →
FAQ
OpenNMS Horizon is an open-source network management platform used for monitoring and managing network devices and services.
The vulnerability allows an authenticated attacker to inject arbitrary scripts into the application, potentially leading to the execution of malicious code.
To fix this vulnerability, upgrade to a fixed version of OpenNMS Horizon, specifically version 27.1.1 or any subsequent version.
No specific workaround is available. It is essential to apply the fix by upgrading to a patched version of OpenNMS Horizon.
For more information, you can refer to the vulnerability details provided in the Open Source Vulnerability format or reach out to info@devnack.com for further support.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.opennms:opennms.
