CVE-2021-25930

Description

In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1 are vulnerable to CSRF, due to no CSRF protection, and since there is no validation of an existing user name while renaming a user. As a result, privileges of the renamed user are being overwritten by the old user and the old user is being deleted from the user list.

Risk Information

Base Score

4.3

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

EPSS Score

Exploitation Probability

0.154

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2021-25933,CVE-2021-25929,CVE-2021-25931,CVE-2021-25930 are fixed in OpenNMS - opennms 27.1.1	Windows
Vulnerabilities CVE-2021-25930 are fixed in OpenNMS - opennms-config 27.1.1	Windows
Vulnerabilities CVE-2021-25933,CVE-2021-25929,CVE-2021-25931,CVE-2021-25930 are fixed in OpenNMS - opennms for Linux 27.1.1	Linux
Vulnerabilities CVE-2021-25930 are fixed in OpenNMS - opennms-config for Linux 27.1.1	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234