What is GHSA-p63h-7hw8-5cw4?

GHSA-p63h-7hw8-5cw4 is a security advisory published by GitHub Security Advisories with Medium severity. Cross-Site Request Forgery in OpenNMS Horizon

Which CVE IDs does GHSA-p63h-7hw8-5cw4 cover?

GHSA-p63h-7hw8-5cw4 covers the following CVE IDs: CVE-2021-25930. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-p63h-7hw8-5cw4?

GHSA-p63h-7hw8-5cw4 has a CVSS v3 base score of 4.3, published by GitHub Security Advisories.

Which products are affected by GHSA-p63h-7hw8-5cw4?

GHSA-p63h-7hw8-5cw4 affects 2 products, including: maven/org.opennms:opennms:\u003e= 1.0.0, \u003c 27.1.1; maven/org.opennms:opennms-config:\u003e= 1.0.0, \u003c 27.1.1.

GHSA-p63h-7hw8-5cw4MediumCVSS 4.3

Cross-Site Request Forgery in OpenNMS Horizon

Vendor

GitHub Security Advisories

Published

May 25, 2021

Last Modified

May 1, 2025

🔗 CVE IDs covered (1)

CVE-2021-25930 →

📋 Description

In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1 are vulnerable to CSRF, due to no CSRF protection, and since there is no validation of an existing user name while renaming a user. As a result, privileges of the renamed user are being overwritten by the old user and the old user is being deleted from the user list.

🎯 Affected products2

maven/org.opennms:opennms:>= 1.0.0, < 27.1.1
maven/org.opennms:opennms-config:>= 1.0.0, < 27.1.1

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2021-25930
https://github.com/OpenNMS/opennms/commit/607151ea8f90212a3fb37c977fa57c7d58d26a84
https://github.com/OpenNMS/opennms/commit/eb08b5ed4c5548f3e941a1f0d0363ae4439fa98c
https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25930
https://github.com/advisories/GHSA-p63h-7hw8-5cw4