CVE-2021-25934: 
Java vulnerability analysis and mitigation

CVE-2021-25934 affects OpenNMS Horizon versions 18.0.0-1 through 27.1.0-1 and OpenNMS Meridian versions from 2015.1.0-1 through 2019.1.18-1 and 2020.1.0-1 through 2020.1.7-1. The vulnerability is a Stored Cross-Site Scripting (XSS) issue in the createRequisitionedNode() function, which fails to validate input for the node-label parameter, allowing attackers to inject malicious scripts that get stored in the database (NVD, WhiteSource).

The vulnerability exists in the createRequisitionedNode() function which lacks proper input validation for the node-label parameter. When adding a new requisition on the server, the function accepts user input without sanitization, allowing arbitrary script injection. The vulnerability has a CVSS v3.1 base score of 5.4 (MEDIUM) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N and a CVSS v2.0 score of 3.5 (LOW) (NVD).

A successful exploitation of this vulnerability allows attackers to inject arbitrary scripts that get stored in the database. When other users access the affected pages, the stored malicious scripts execute in their browsers, potentially leading to session hijacking, defacement, or theft of sensitive information (WhiteSource).

The vulnerability can be exploited by an authenticated attacker by navigating to the opennms/admin/ng-requisitions/index.jsp#/requisitions endpoint, adding a new requisition, using the Quick Add Note feature, and injecting malicious payload in the Node label field. The attack requires user interaction and low privileges (WhiteSource).

Users should upgrade to OpenNMS Horizon 27.1.1, Meridian 2020.1.8, or Meridian 2019.1.19 to address this vulnerability. The fix involves implementing proper input validation and escaping mechanisms for the node-label parameter (WhiteSource).