CVE-2020-11886
Last modified
CVE-2020-11886 is a high-severity vulnerability rated 8.1/10 on the CVSS scale. OpenNMS Horizon and Meridian allows HQL Injection in element/nodeList.htm (aka the NodeListController) via snmpParm or snmpParmValue to addCriteriaForSnmpParm. This affects Horizon before 25.2.1, Meridian 2019 before 2019.1.4, Meridian 2018 before 2018.1.16, and Meridian 2017 before 2017.1.21.. EPSS estimates a 1.38% chance of exploitation in the next 30 days.
Description
OpenNMS Horizon and Meridian allows HQL Injection in element/nodeList.htm (aka the NodeListController) via snmpParm or snmpParmValue to addCriteriaForSnmpParm. This affects Horizon before 25.2.1, Meridian 2019 before 2019.1.4, Meridian 2018 before 2018.1.16, and Meridian 2017 before 2017.1.21.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Opennms | Horizon | < 25.2.1 |
| Opennms | Meridian | >= 2017, < 2017.1.21 |
| Opennms | Meridian | >= 2018, < 2018.1.16 |
| Opennms | Meridian | >= 2019, < 2019.1.4 |
References
- https://issues.opennms.org/browse/NMS-12572Vendor Advisory
- https://issues.opennms.org/browse/NMS-12572Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2020-11886?
How severe is CVE-2020-11886?
How do I fix CVE-2020-11886?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2020
- CVE-2020-11880An issue was discovered in KDE KMail before 19.12.3. By usin…6.5
- CVE-2020-11881An array index error in MikroTik RouterOS 6.41.3 through 6.4…7.5
- CVE-2020-11882The O2 Business application 1.2.0 for Android exposes the ca…6.1
- CVE-2020-11883In Divante vue-storefront-api through 1.11.1 and storefront-…5.3
- CVE-2020-11884In the Linux kernel 4.19 through 5.6.7 on the s390 platform,…7
- CVE-2020-11885WSO2 Enterprise Integrator through 6.6.0 has an XXE vulnerab…7.2
- CVE-2020-11887svg2png 4.1.1 allows XSS with resultant SSRF via JavaScript …6.1
- CVE-2020-11888python-markdown2 through 2.3.8 allows XSS because element na…6.1
- CVE-2020-11889An issue was discovered in Joomla! before 3.9.17. Incorrect …5.3
- CVE-2020-1189An elevation of privilege vulnerability exists when the Wind…7.8
- CVE-2020-11890An issue was discovered in Joomla! before 3.9.17. Improper i…5.3
- CVE-2020-11891An issue was discovered in Joomla! before 3.9.17. Incorrect …5.3
Are you affected by CVE-2020-11886?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST