From c9647ce4e5a2f6ebb589ef47a96c7abc50e17c72 Mon Sep 17 00:00:00 2001 From: Tod Beardsley Date: Fri, 10 Sep 2021 17:41:32 -0500 Subject: [PATCH 1/2] Add Matthew's OpenNMS bugs --- 2016/6xxx/CVE-2016-6555.json | 89 ++++++++++++++++++++++++++++++++++-- 2016/6xxx/CVE-2016-6556.json | 89 ++++++++++++++++++++++++++++++++++-- 2 files changed, 170 insertions(+), 8 deletions(-) diff --git a/2016/6xxx/CVE-2016-6555.json b/2016/6xxx/CVE-2016-6555.json index 120652f5f04..6ba7fba80db 100644 --- a/2016/6xxx/CVE-2016-6555.json +++ b/2016/6xxx/CVE-2016-6555.json @@ -1,9 +1,42 @@ { "CVE_data_meta": { - "ASSIGNER": "cve@mitre.org", + "ASSIGNER": "cve@rapid7.com", + "DATE_PUBLIC": "2016-09-14T18:18:00.000Z", "ID": "CVE-2016-6555", - "STATE": "RESERVED" + "STATE": "PUBLIC", + "TITLE": "OpenNMS Stored XSS via SNMP Trap Alerts" }, + "affects": { + "vendor": { + "vendor_data": [ + { + "product": { + "product_data": [ + { + "product_name": "OpenNMS", + "version": { + "version_data": [ + { + "version_affected": "<=", + "version_name": "18.0.1", + "version_value": "18.0.1" + } + ] + } + } + ] + }, + "vendor_name": "OpenNMS" + } + ] + } + }, + "credit": [ + { + "lang": "eng", + "value": "This issue was discovered by Matthew Kienow and disclosure was coordinated by Rapid7." + } + ], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", @@ -11,8 +44,56 @@ "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "OpenNMS version 18.0.1 and prior are vulnerable to a stored XSS issue due to insufficient filtering of SNMP trap supplied data. By creating a malicious SNMP trap, an attacker can store an XSS payload which will trigger when a user of the web UI views the data. This issue was fixed in version 18.0.2, released on September 20, 2016." } ] + }, + "generator": { + "engine": "Vulnogram 0.0.9" + }, + "impact": { + "cvss": { + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "NONE", + "baseScore": 7.1, + "baseSeverity": "HIGH", + "confidentialityImpact": "HIGH", + "integrityImpact": "LOW", + "privilegesRequired": "NONE", + "scope": "UNCHANGED", + "userInteraction": "REQUIRED", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N", + "version": "3.1" + } + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-79 Cross-site Scripting (XSS)" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "name": "https://www.rapid7.com/blog/post/2016/11/15/r7-2016-24-opennms-stored-xss-via-snmp-cve-2016-6555-cve-2016-6556/", + "refsource": "MISC", + "url": "https://www.rapid7.com/blog/post/2016/11/15/r7-2016-24-opennms-stored-xss-via-snmp-cve-2016-6555-cve-2016-6556/" + }, + { + "name": "https://github.com/OpenNMS/opennms/pull/1019", + "refsource": "MISC", + "url": "https://github.com/OpenNMS/opennms/pull/1019" + } + ] + }, + "source": { + "discovery": "UNKNOWN" } -} \ No newline at end of file +} diff --git a/2016/6xxx/CVE-2016-6556.json b/2016/6xxx/CVE-2016-6556.json index d2212dd21b3..47e2eff586a 100644 --- a/2016/6xxx/CVE-2016-6556.json +++ b/2016/6xxx/CVE-2016-6556.json @@ -1,9 +1,42 @@ { "CVE_data_meta": { - "ASSIGNER": "cve@mitre.org", + "ASSIGNER": "cve@rapid7.com", + "DATE_PUBLIC": "2016-09-14T18:18:00.000Z", "ID": "CVE-2016-6556", - "STATE": "RESERVED" + "STATE": "PUBLIC", + "TITLE": "OpenNMS Stored XSS via SNMP Agent Data" }, + "affects": { + "vendor": { + "vendor_data": [ + { + "product": { + "product_data": [ + { + "product_name": "OpenNMS", + "version": { + "version_data": [ + { + "version_affected": "<=", + "version_name": "18.0.1", + "version_value": "18.0.1" + } + ] + } + } + ] + }, + "vendor_name": "OpenNMS" + } + ] + } + }, + "credit": [ + { + "lang": "eng", + "value": "This issue was discovered by Matthew Kienow and disclosure was coordinated by Rapid7." + } + ], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", @@ -11,8 +44,56 @@ "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "OpenNMS version 18.0.1 and prior are vulnerable to a stored XSS issue due to insufficient filtering of SNMP agent supplied data. By creating a malicious SNMP 'sysName' response, an attacker can store an XSS payload which will trigger when a user of the web UI views the data. This issue was fixed in version 18.0.2-1, released on September 20, 2016." } ] + }, + "generator": { + "engine": "Vulnogram 0.0.9" + }, + "impact": { + "cvss": { + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "NONE", + "baseScore": 7.1, + "baseSeverity": "HIGH", + "confidentialityImpact": "HIGH", + "integrityImpact": "LOW", + "privilegesRequired": "NONE", + "scope": "UNCHANGED", + "userInteraction": "REQUIRED", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N", + "version": "3.1" + } + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-79 Cross-site Scripting (XSS)" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "name": "https://www.rapid7.com/blog/post/2016/11/15/r7-2016-24-opennms-stored-xss-via-snmp-cve-2016-6555-cve-2016-6556/", + "refsource": "MISC", + "url": "https://www.rapid7.com/blog/post/2016/11/15/r7-2016-24-opennms-stored-xss-via-snmp-cve-2016-6555-cve-2016-6556/" + }, + { + "name": "https://github.com/OpenNMS/opennms/pull/1019", + "refsource": "MISC", + "url": "https://github.com/OpenNMS/opennms/pull/1019" + } + ] + }, + "source": { + "discovery": "UNKNOWN" } -} \ No newline at end of file +} From 2205c69aaf3830fa8a556530da103e7ea7e530ab Mon Sep 17 00:00:00 2001 From: Tod Beardsley Date: Fri, 10 Sep 2021 19:02:39 -0500 Subject: [PATCH 2/2] Update descriptions --- 2016/6xxx/CVE-2016-6555.json | 2 +- 2016/6xxx/CVE-2016-6556.json | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/2016/6xxx/CVE-2016-6555.json b/2016/6xxx/CVE-2016-6555.json index 6ba7fba80db..4f88065f878 100644 --- a/2016/6xxx/CVE-2016-6555.json +++ b/2016/6xxx/CVE-2016-6555.json @@ -44,7 +44,7 @@ "description_data": [ { "lang": "eng", - "value": "OpenNMS version 18.0.1 and prior are vulnerable to a stored XSS issue due to insufficient filtering of SNMP trap supplied data. By creating a malicious SNMP trap, an attacker can store an XSS payload which will trigger when a user of the web UI views the data. This issue was fixed in version 18.0.2, released on September 20, 2016." + "value": "OpenNMS version 18.0.1 and prior are vulnerable to a stored XSS issue due to insufficient filtering of SNMP trap supplied data. By creating a malicious SNMP trap, an attacker can store an XSS payload which will trigger when a user of the web UI views the events list page. This issue was fixed in version 18.0.2, released on September 20, 2016." } ] }, diff --git a/2016/6xxx/CVE-2016-6556.json b/2016/6xxx/CVE-2016-6556.json index 47e2eff586a..955645d0943 100644 --- a/2016/6xxx/CVE-2016-6556.json +++ b/2016/6xxx/CVE-2016-6556.json @@ -44,7 +44,7 @@ "description_data": [ { "lang": "eng", - "value": "OpenNMS version 18.0.1 and prior are vulnerable to a stored XSS issue due to insufficient filtering of SNMP agent supplied data. By creating a malicious SNMP 'sysName' response, an attacker can store an XSS payload which will trigger when a user of the web UI views the data. This issue was fixed in version 18.0.2-1, released on September 20, 2016." + "value": "OpenNMS version 18.0.1 and prior are vulnerable to a stored XSS issue due to insufficient filtering of SNMP agent supplied data. By creating a malicious SNMP 'sysName' or 'sysContact' response, an attacker can store an XSS payload which will trigger when a user of the web UI views the data. This issue was fixed in version 18.0.2, released on September 20, 2016." } ] },