CVE-2021-3396

Published: Feb 17, 2021Modified: Jun 17, 2026

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

OpenNMS Meridian 2016, 2017, 2018 before 2018.1.25, 2019 before 2019.1.16, and 2020 before 2020.1.5, Horizon 1.2 through 27.0.4, and Newts <1.5.3 has Incorrect Access Control, which allows local and remote code execution using JEXL expressions.

Affected (7)

Products: Opennms: Horizon, Meridian, Newts

3 products

Configuration A

7 vulnerable

Vulnerable Software	Affected Versions
Opennms Horizon	16.0.0 ≤ version ≤ 27.0.3
Opennms Meridian	2016.1.0 ≤ version ≤ 2016.1.24
Opennms Meridian	2017.1.0 ≤ version ≤ 2017.1.26
Opennms Meridian	2018.1.0 ≤ version < 2018.1.25
Opennms Meridian	2019.1.0 ≤ version < 2019.1.16
Opennms Meridian	2020.1.0 ≤ version < 2020.1.5
Opennms Newts	version < 1.5.3

References (4)

https://www.opennms.com

Source: cve@mitre.org

Vendor Advisory

https://www.opennms.com/en/blog/2021-02-16-cve-2021-3396-full-security-disclosure/

Source: cve@mitre.org

Vendor Advisory

https://www.opennms.com

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://www.opennms.com/en/blog/2021-02-16-cve-2021-3396-full-security-disclosure/

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.