CVE-2021-25929: 
Java vulnerability analysis and mitigation

A Stored Cross-Site Scripting (XSS) vulnerability was discovered in OpenNMS Horizon (versions opennms-1-0-stable through opennms-27.1.0-1) and OpenNMS Meridian (versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1 and meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1). The vulnerability exists due to lack of input validation on the 'name' parameter in the 'noticeWizard' endpoint (WhiteSource DB).

The vulnerability allows an authenticated attacker to inject arbitrary scripts through the 'name' parameter in the noticeWizard endpoint due to missing input validation. The issue specifically affects the 'opennms' module and can be exploited through the path 'opennms/admin/notification/noticeWizard/choosePath.jsp'. The vulnerability has been assigned a CVSS v3.1 base score of 4.8, with attack vector being Network, attack complexity Low, requiring High privileges, and User Interaction (WhiteSource DB).

If successfully exploited, this vulnerability could allow an authenticated attacker to inject malicious scripts that could trick other admin users into downloading malicious files, potentially causing severe damage to the organization using OpenNMS (WhiteSource DB).

The vulnerability requires authentication to exploit. An attacker needs to navigate to the noticeWizard endpoint, insert a malicious payload into the 'Name' field, and add text in the 'Test Message' field (which is mandatory). Successful exploitation results in script execution, confirmed by a pop-up display (WhiteSource DB).

Users should upgrade to Horizon 2.7.1.1, Meridian 2020.1.7, or Meridian 2019.1.19 to address this vulnerability. The fix has been implemented in these versions to prevent XSS attacks through proper input validation (WhiteSource DB).