1. Home
  2. CVE Database
  3. CVE-2020-11886
HIGH · 8.1

CVE-2020-11886

OpenNMS Horizon and Meridian allows HQL Injection in element/nodeList.htm (aka the NodeListController) via snmpParm or snmpParmValue to addCriteriaForSnmpParm. This affects Horizon before 25.2.1, Meri...

Vulnerability Description

OpenNMS Horizon and Meridian allows HQL Injection in element/nodeList.htm (aka the NodeListController) via snmpParm or snmpParmValue to addCriteriaForSnmpParm. This affects Horizon before 25.2.1, Meridian 2019 before 2019.1.4, Meridian 2018 before 2018.1.16, and Meridian 2017 before 2017.1.21.

CVSS Score

8.1

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
NONE

Affected Products

VendorProductVersions
OpennmsHorizon< 25.2.1
OpennmsMeridian>= 2017, < 2017.1.21

Related Weaknesses (CWE)

CWE-89

References

FAQ

What is CVE-2020-11886?

CVE-2020-11886 is a vulnerability with a CVSS score of 8.1 (HIGH). OpenNMS Horizon and Meridian allows HQL Injection in element/nodeList.htm (aka the NodeListController) via snmpParm or snmpParmValue to addCriteriaForSnmpParm. This affects Horizon before 25.2.1, Meri...

How severe is CVE-2020-11886?

CVE-2020-11886 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2020-11886?

Check the references section above for vendor advisories and patch information. Affected products include: Opennms Horizon, Opennms Meridian.