Stored Cross-Site Scripting in OpenMNS Horizon by OpenNMS

CVE-2025-53121

What is CVE-2025-53121?

Multiple stored XSS vulnerabilities were identified in OpenMNS Horizon versions 33.0.8 and earlier, alongside the Meridian releases prior to 2024.2.6. These vulnerabilities leverage unsanitized parameters, allowing attackers to store malicious scripts in the database. As a result, when these scripts are executed on web pages, they can inject unauthorized HTML or JavaScript, posing significant security risks. OpenNMS advises upgrading to Horizon versions 33.1.6 or newer, and Meridian versions 2024.2.6 or newer to mitigate these vulnerabilities. It is essential to follow installation guidelines, as both Horizon and Meridian are designed for private network segmentation and should not be exposed to the Internet. Acknowledgment is given to Fábio Tomé for bringing this issue to light.

References