CVE-2021-3396
High
Description
OpenNMS Meridian 2016, 2017, 2018 before 2018.1.25, 2019 before 2019.1.16, and 2020 before 2020.1.5, Horizon 1.2 through 27.0.4, and Newts <1.5.3 has Incorrect Access Control, which allows local and remote code execution using JEXL expressions.
SeverityHigh
CVSS8.8
Exploit probability—
ProductOpennms Horizon
PublishedFeb 17, 2021
First seenFeb 17, 2021
How to fix
Update
- opennms meridian2018.1.25, 2019.1.16, 2020.1.5 or later
- opennms newts1.5.3 or later
- org.opennms:opennms27.0.4 or later
- org.opennms.features:org.opennms.features.measurements27.0.4 or later
- org.opennms:opennms-provision27.0.4 or later
- org.opennms:opennms-util27.0.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| opennms horizon | 16.0.0 ≤ v ≤ 27.0.3 | — |
| opennms meridian | 2016.1.0 ≤ v ≤ 2016.1.24, 2017.1.0 ≤ v ≤ 2017.1.26, 2018.1.0 ≤ v < 2018.1.25, 2019.1.0 ≤ v < 2019.1.16, 2020.1.0 ≤ v < 2020.1.5 | 2018.1.25, 2019.1.16, 2020.1.5 |
| opennms newts | v < 1.5.3 | 1.5.3 |
| org.opennms:opennmsMaven | 16.0.0 ≤ v < 27.0.4 | 27.0.4 |
| org.opennms.features:org.opennms.features.measurementsMaven | 16.0.0 ≤ v < 27.0.4 | 27.0.4 |
| org.opennms:opennms-provisionMaven | 16.0.0 ≤ v < 27.0.4 | 27.0.4 |
| org.opennms:opennms-utilMaven | 16.0.0 ≤ v < 27.0.4 | 27.0.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.