PT-2025-27008 · Openmns · Opennms Horizon+1

Fábio Tomé · Published 2025-06-26 · Updated 2025-06-27 · CVE-2025-53121

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:A/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Name of the Vulnerable Software and Affected Versions: OpenMNS Horizon versions 33.0.8 through 33.1.5 OpenMNS Meridian versions prior to 2024.2.6

Description: Multiple stored XSS issues were found in OpenMNS Horizon due to unsanitized parameters on different nodes, allowing an attacker to store and inject HTML and/or Javascript on the page. The affected software is intended for installation within an organization's private networks and should not be directly accessible from the Internet.

Recommendations: For OpenMNS Horizon versions 33.0.8 through 33.1.5, upgrade to Horizon 33.1.6 or newer. For OpenMNS Meridian versions prior to 2024.2.6, upgrade to Meridian 2024.2.6 or newer. As a temporary workaround, consider restricting access to the affected nodes to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-53121

Affected Products

Opennms Horizon

Opennms Meridian

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-53121 · Security Note
• https://osv.dev/vulnerability/CVE-2025-53121 · Vendor Advisory
• https://github.com/OpenNMS/opennms · Note
• https://github.com/OpenNMS/opennms/pull/7708 · Note
• https://t.me/cvetracker/27164 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1938397573858869368 · Twitter Post
• https://twitter.com/CVEnew/status/1938314622198555035 · Twitter Post