CVE-2016-6556

Published September 24th, 2021

View on NVD ↗

CVSS v3

7.1

HIGH

CVSS v2

4.3

MEDIUM

Affected

PROJECT

Description

OpenNMS version 18.0.1 and prior are vulnerable to a stored XSS issue due to insufficient filtering of SNMP agent supplied data. By creating a malicious SNMP 'sysName' or 'sysContact' response, an attacker can store an XSS payload which will trigger when a user of the web UI views the data. This issue was fixed in version 18.0.2, released on September 20, 2016.

OpenNMS/opennms

Enterprise-Grade Open-Source Network Management Platform

GitHub

1.16K