Secunia

Some vulnerabilities have been reported in OpenNMS, which can be exploited by malicious people to conduct cross-site scripting attacks.

Input passed to the "j_username" parameter in j_acegi_security_check, to the "username" parameter in notification/list.jsp, and to the "filter" parameter in event/list is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

The vulnerabilities are reported in versions prior to 1.5.94.

Solution
Fixed in version 1.5.94.

Provided and/or discovered by
d2d via an OpenNMS bug report

Changelog
Further details available in Customer Area

Original Advisory
http://www.opennms.org/documentation/ReleaseNotesUnStable.html#d788e257
http://bugzilla.opennms.org/show_bug.cgi?id=2631
http://bugzilla.opennms.org/show_bug.cgi?id=2633
http://bugzilla.opennms.org/show_bug.cgi?id=2634

Deep Links
Links available in Customer Area