What is GHSA-c3mp-9vx3-2rvv?

GHSA-c3mp-9vx3-2rvv is a security advisory published by GitHub Security Advisories with High severity. OpenNMS Horizon RCE via JEXL2 expression

Which CVE IDs does GHSA-c3mp-9vx3-2rvv cover?

GHSA-c3mp-9vx3-2rvv covers the following CVE IDs: CVE-2021-3396. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-c3mp-9vx3-2rvv?

GHSA-c3mp-9vx3-2rvv has a CVSS v3 base score of 8.8, published by GitHub Security Advisories.

Which products are affected by GHSA-c3mp-9vx3-2rvv?

GHSA-c3mp-9vx3-2rvv affects 4 products, including: maven/org.opennms:opennms:\u003e= 16.0.0, \u003c= 27.0.3; maven/org.opennms.features:org.opennms.features.measurements:\u003e= 16.0.0, \u003c= 27.0.3; maven/org.opennms:opennms-provision:\u003e= 16.0.0, \u003c= 27.0.3; maven/org.opennms:opennms-util:\u003e= 16.0.0, \u003c= 27.0.3.

GHSA-c3mp-9vx3-2rvvHighCVSS 8.8

OpenNMS Horizon RCE via JEXL2 expression

Vendor

GitHub Security Advisories

Published

May 24, 2022

Last Modified

August 3, 2023

🔗 CVE IDs covered (1)

CVE-2021-3396 →

📋 Description

OpenNMS Meridian 2016, 2017, 2018 before 2018.1.25, 2019 before 2019.1.16, and 2020 before 2020.1.5, Horizon 1.2 through 27.0.4, and Newts <1.5.3 has Incorrect Access Control, which allows local and remote code execution using JEXL expressions.

🎯 Affected products4

maven/org.opennms:opennms:>= 16.0.0, <= 27.0.3
maven/org.opennms.features:org.opennms.features.measurements:>= 16.0.0, <= 27.0.3
maven/org.opennms:opennms-provision:>= 16.0.0, <= 27.0.3
maven/org.opennms:opennms-util:>= 16.0.0, <= 27.0.3

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2021-3396
https://www.opennms.com/en/blog/2021-02-16-cve-2021-3396-full-security-disclosure/
https://github.com/OpenNMS/opennms/pull/3281
https://issues.opennms.org/browse/NMS-13103
https://github.com/advisories/GHSA-c3mp-9vx3-2rvv