CVE-2012-0936

Description

Cross-site scripting (XSS) vulnerability in web/springframework/security/SecurityAuthenticationEventOnmsEventBuilder.java in OpenNMS 1.8.x before 1.8.17, 1.9.93 and earlier, and 1.10.x before 1.10.1 allows remote attackers to inject arbitrary web script or HTML via the Username field, related to login.

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/72625

https://euvd.enisa.europa.eu/vulnerability/EUVD-2012-0959

http://www.securityfocus.com/bid/51632

http://secunia.com/advisories/47646

http://osvdb.org/78454

http://issues.opennms.org/browse/NMS/fixforversion/10825

http://issues.opennms.org/browse/NMS/fixforversion/10824#atl_token=BCL8-RCDX-MB62-2EZT%7C38eaf469042162355c28f5393587690a8388d556%7Clout&selectedTab=com.atlassian.jira.plugin.system.project%3Aversion-summary-panel

http://issues.opennms.org/browse/NMS-5128?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel#issue-tabs

http://fisheye.opennms.org/browse/opennms/features/springframework-security/src/main/java/org/opennms/web/springframework/security/SecurityAuthenticationEventOnmsEventBuilder.java?r2=d2ce15470cb6c87c115c918eb86ef147486a9166&r1=80b80e110e4bce568fc2c6c0a15a

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

EPSS