Back to Database
Status published
High
CVE-2020-11886
OpenNMS Horizon and Meridian allows HQL Injection in element/nodeList.htm (aka...
Vulnerability Description
OpenNMS Horizon and Meridian allows HQL Injection in element/nodeList.htm (aka the NodeListController) via snmpParm or snmpParmValue to addCriteriaForSnmpParm. This affects Horizon before 25.2.1, Meridian 2019 before 2019.1.4, Meridian 2018 before 2018.1.16, and Meridian 2017 before 2017.1.21.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-11886
Credits & Attribution
No credits recorded in the NVD database.
References
More from opennms
View All →CVE-2021-3396
OpenNMS Meridian 2016, 2017, 2018 before 2018.1.25, 2019 before 2019.1.16,...
High
8.8
CVE-2020-12760
An issue was discovered in OpenNMS Horizon before 26.0.1, and...
High
8.8
CVE-2015-7856
OpenNMS has a default password of rtc for the rtc...
Critical
10
CVE-2014-3960
Multiple cross-site scripting (XSS) vulnerabilities in OpenNMS before 1.12.7 allow...
Medium
4.3
CVE-2008-6095
Cross-site scripting (XSS) vulnerability in surveillanceView.htm in OpenNMS 1.5.94 allows...
Medium
4.3
Affected Vendor
opennms
View all reports →Affected Software
horizon, meridian
Vulnerable Versions:
0, 2017, 2018, 2019
Timeline
Official Publish:
April 17th, 2020
Last Modified:
August 4th, 2024
Added to House:
July 21st, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.