CVE-2021-25930: Cross-Site Request Forgery in OpenNMS Horizon
(updated )
In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1 are vulnerable to CSRF, due to no CSRF protection, and since there is no validation of an existing user name while renaming a user. As a result, privileges of the renamed user are being overwritten by the old user and the old user is being deleted from the user list.
References
- github.com/OpenNMS/opennms
- github.com/OpenNMS/opennms/commit/607151ea8f90212a3fb37c977fa57c7d58d26a84
- github.com/OpenNMS/opennms/commit/eb08b5ed4c5548f3e941a1f0d0363ae4439fa98c
- github.com/advisories/GHSA-p63h-7hw8-5cw4
- nvd.nist.gov/vuln/detail/CVE-2021-25930
- www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25930
Code Behaviors & Features
Detect and mitigate CVE-2021-25930 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →