CVE-2016-6556

2021-09-2421:15:07

Google

osv.dev

0.001 Low

EPSS

Percentile

33.3%

JSON

OpenNMS version 18.0.1 and prior are vulnerable to a stored XSS issue due to insufficient filtering of SNMP agent supplied data. By creating a malicious SNMP ‘sysName’ or ‘sysContact’ response, an attacker can store an XSS payload which will trigger when a user of the web UI views the data. This issue was fixed in version 18.0.2, released on September 20, 2016.

CPENameOperatorVersion
opennmseqopennms-1.10.5-1
opennmseqopennms-17.0.0-1
opennmseqopennms-1.13.2-1
opennmseqopennms-1.12.8-1
opennmseqopennms-17.1.1-2
opennmseqopennms-1.10.0-1
opennmseqopennms-1.11.91-1
opennmseqopennms-1.12.6-1
opennmseqopennms-1.12.9-1
opennmseqmeridian-foundation-2015.1.0-1

Name	Operator	Version
opennms	eq	opennms-1.10.5-1
opennms	eq	opennms-17.0.0-1
opennms	eq	opennms-1.13.2-1
opennms	eq	opennms-1.12.8-1
opennms	eq	opennms-17.1.1-2
opennms	eq	opennms-1.10.0-1
opennms	eq	opennms-1.11.91-1
opennms	eq	opennms-1.12.6-1
opennms	eq	opennms-1.12.9-1
opennms	eq	meridian-foundation-2015.1.0-1