CVE-2008-4320

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2008-09-29 · updated 2026-06-16
Weakness: CWE-79

Description

Multiple cross-site scripting (XSS) vulnerabilities in OpenNMS before 1.5.94 allow remote attackers to inject arbitrary web script or HTML via (1) the j_username parameter to j_acegi_security_check, (2) the username parameter to notification/list.jsp, and (3) the filter parameter to event/list.

Affected products

Opennms.Org Opennms: through 1.0.0; through 1.1.0; through 1.2.0; through 1.3.0; through 1.5.90; 1.1.1, 1.1.2, 1.1.3, 1.1.4, 1.1.5, 1.2.1 (+17)

References

http://bugzilla.opennms.org/show_bug.cgi?id=2631
http://bugzilla.opennms.org/show_bug.cgi?id=2633
http://bugzilla.opennms.org/show_bug.cgi?id=2634
http://secunia.com/advisories/32019
http://www.opennms.org/documentation/ReleaseNotesUnStable.html#d788e257
http://www.securityfocus.com/bid/31410
https://exchange.xforce.ibmcloud.com/vulnerabilities/45417
http://bugzilla.opennms.org/show_bug.cgi?id=2631
http://bugzilla.opennms.org/show_bug.cgi?id=2633
http://bugzilla.opennms.org/show_bug.cgi?id=2634
http://secunia.com/advisories/32019
http://www.opennms.org/documentation/ReleaseNotesUnStable.html#d788e257

Get alerted when CVE-2008-4320 or the next vulnerability affects your stack