CVE-2016-6556
High
Description
OpenNMS version 18.0.1 and prior are vulnerable to a stored XSS issue due to insufficient filtering of SNMP agent supplied data. By creating a malicious SNMP 'sysName' or 'sysContact' response, an attacker can store an XSS payload which will trigger when a user of the web UI views the data. This issue was fixed in version 18.0.2, released on September 20, 2016.
SeverityHigh
CVSS7.1
Exploit probability—
ProductOpennms
PublishedSep 24, 2021
First seenSep 24, 2021
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Update
- opennms opennms18.0.2-1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| opennms opennms | v < 18.0.2-1 | 18.0.2-1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.