CVE-2016-6555

OpenNMS Stored XSS via SNMP Trap Alerts

State: Published
Severity: 7.1 High
Published: Jun 15, 2022
Updated: Sep 17, 2024
Reserved: Aug 3, 2016

Description

OpenNMS version 18.0.1 and prior are vulnerable to a stored XSS issue due to insufficient filtering of SNMP trap supplied data. By creating a malicious SNMP trap, an attacker can store an XSS payload which will trigger when a user of the web UI views the events list page. This issue was fixed in version 18.0.2, released on September 20, 2016.

Scores

CVSS	Score	Vector	Source
3.1	7.1 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N	rapid7

Weaknesses

CWE-79 Cross-site Scripting (XSS)

Affected Products

Product	Versions
OpenNMSOpenNMS	18.0.1 through 18.0.1Affected

References

https://www.rapid7.com/blog/post/2016/11/15/r7-2016-24-opennms-stored-xss-via-snmp-cve-2016-6555-cve-2016-6556/
https://github.com/OpenNMS/opennms/pull/1019

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.