Vulnerabilites related to opennms - newts
Vulnerability from fkie_nvd
Published
2021-02-17 21:15
Modified
2024-11-21 06:21
Severity ?
Summary
OpenNMS Meridian 2016, 2017, 2018 before 2018.1.25, 2019 before 2019.1.16, and 2020 before 2020.1.5, Horizon 1.2 through 27.0.4, and Newts <1.5.3 has Incorrect Access Control, which allows local and remote code execution using JEXL expressions.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:opennms:horizon:*:*:*:*:*:*:*:*",
"matchCriteriaId": "6514B3D6-FF65-419B-8703-E1E099B14133",
"versionEndIncluding": "27.0.3",
"versionStartIncluding": "16.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:opennms:meridian:*:*:*:*:*:*:*:*",
"matchCriteriaId": "65ADE797-2053-4420-B1BE-63B1338104CB",
"versionEndIncluding": "2016.1.24",
"versionStartIncluding": "2016.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:opennms:meridian:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E81416D1-B874-4D00-86C0-928AFC6D9A98",
"versionEndIncluding": "2017.1.26",
"versionStartIncluding": "2017.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:opennms:meridian:*:*:*:*:*:*:*:*",
"matchCriteriaId": "9EC6B5D3-EA6D-4C13-B74E-B5BEA825243F",
"versionEndExcluding": "2018.1.25",
"versionStartIncluding": "2018.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:opennms:meridian:*:*:*:*:*:*:*:*",
"matchCriteriaId": "A64A562E-4797-4A06-879B-02886AA6DD27",
"versionEndExcluding": "2019.1.16",
"versionStartIncluding": "2019.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:opennms:meridian:*:*:*:*:*:*:*:*",
"matchCriteriaId": "1AA3C085-8DCA-4E6A-A201-73B2143D7FFE",
"versionEndExcluding": "2020.1.5",
"versionStartIncluding": "2020.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:opennms:newts:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E46F90CA-50A7-4526-BF00-9B4ADF807B24",
"versionEndExcluding": "1.5.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "OpenNMS Meridian 2016, 2017, 2018 before 2018.1.25, 2019 before 2019.1.16, and 2020 before 2020.1.5, Horizon 1.2 through 27.0.4, and Newts \u003c1.5.3 has Incorrect Access Control, which allows local and remote code execution using JEXL expressions."
},
{
"lang": "es",
"value": "OpenNMS Meridian versiones 2016, 2017, 2018 anteriores a 2018.1.25, versiones 2019 anteriores a 2019.1.16 y versiones 2020 anteriores a 2020.1.5, Horizon versiones 1.2 hasta 27.0.4 y Newts versiones anteriores a 1.5.3, presenta un Control de Acceso Incorrecto, que permite una ejecuci\u00f3n de c\u00f3digo local y remota utilizando expresiones JEXL"
}
],
"id": "CVE-2021-3396",
"lastModified": "2024-11-21T06:21:24.703",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-02-17T21:15:13.120",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "https://www.opennms.com"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "https://www.opennms.com/en/blog/2021-02-16-cve-2021-3396-full-security-disclosure/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.opennms.com"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.opennms.com/en/blog/2021-02-16-cve-2021-3396-full-security-disclosure/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
CVE-2021-3396 (GCVE-0-2021-3396)
Vulnerability from cvelistv5
Published
2021-02-17 20:13
Modified
2024-08-03 16:53
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
OpenNMS Meridian 2016, 2017, 2018 before 2018.1.25, 2019 before 2019.1.16, and 2020 before 2020.1.5, Horizon 1.2 through 27.0.4, and Newts <1.5.3 has Incorrect Access Control, which allows local and remote code execution using JEXL expressions.
References
| ► | URL | Tags | ||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T16:53:17.568Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.opennms.com"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.opennms.com/en/blog/2021-02-16-cve-2021-3396-full-security-disclosure/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OpenNMS Meridian 2016, 2017, 2018 before 2018.1.25, 2019 before 2019.1.16, and 2020 before 2020.1.5, Horizon 1.2 through 27.0.4, and Newts \u003c1.5.3 has Incorrect Access Control, which allows local and remote code execution using JEXL expressions."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-02-17T20:13:54",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.opennms.com"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.opennms.com/en/blog/2021-02-16-cve-2021-3396-full-security-disclosure/"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2021-3396",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "OpenNMS Meridian 2016, 2017, 2018 before 2018.1.25, 2019 before 2019.1.16, and 2020 before 2020.1.5, Horizon 1.2 through 27.0.4, and Newts \u003c1.5.3 has Incorrect Access Control, which allows local and remote code execution using JEXL expressions."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.opennms.com",
"refsource": "MISC",
"url": "https://www.opennms.com"
},
{
"name": "https://www.opennms.com/en/blog/2021-02-16-cve-2021-3396-full-security-disclosure/",
"refsource": "CONFIRM",
"url": "https://www.opennms.com/en/blog/2021-02-16-cve-2021-3396-full-security-disclosure/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-3396",
"datePublished": "2021-02-17T20:13:54",
"dateReserved": "2021-02-03T00:00:00",
"dateUpdated": "2024-08-03T16:53:17.568Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}