Back to Database
Status published
High
CVE-2021-3396
OpenNMS Meridian 2016, 2017, 2018 before 2018.1.25, 2019 before 2019.1.16,...
Vulnerability Description
OpenNMS Meridian 2016, 2017, 2018 before 2018.1.25, 2019 before 2019.1.16, and 2020 before 2020.1.5, Horizon 1.2 through 27.0.4, and Newts <1.5.3 has Incorrect Access Control, which allows local and remote code execution using JEXL expressions.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-3396
Credits & Attribution
No credits recorded in the NVD database.
References
More from opennms
View All →CVE-2020-12760
An issue was discovered in OpenNMS Horizon before 26.0.1, and...
High
8.8
CVE-2020-11886
OpenNMS Horizon and Meridian allows HQL Injection in element/nodeList.htm (aka...
High
8.1
CVE-2015-7856
OpenNMS has a default password of rtc for the rtc...
Critical
10
CVE-2014-3960
Multiple cross-site scripting (XSS) vulnerabilities in OpenNMS before 1.12.7 allow...
Medium
4.3
CVE-2008-6095
Cross-site scripting (XSS) vulnerability in surveillanceView.htm in OpenNMS 1.5.94 allows...
Medium
4.3
Affected Vendor
opennms
View all reports →Affected Software
horizon, meridian, newts
Vulnerable Versions:
16.0.0, 2016.1.0, 2017.1.0, 2018.1.0, 2019.1.0, 2020.1.0, 0
Timeline
Official Publish:
February 17th, 2021
Last Modified:
August 3rd, 2024
Added to House:
July 21st, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.