PT-2020-13250 · Opennms+1 · Opennms Horizon+2

Florian Hauser · Published 2020-05-11 · Updated 2022-05-24 · CVE-2020-12760

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenNMS Horizon versions prior to 26.0.1 OpenNMS Meridian versions prior to 2018.1.19 OpenNMS Meridian 2019 versions prior to 2019.1.7

Description An issue allows for arbitrary deserialization of Java objects, leading to remote code execution for any authenticated channel user regardless of its assigned permissions. This is related to the ActiveMQ channel configuration and affects authenticated users.

Recommendations For OpenNMS Horizon versions prior to 26.0.1, update to version 26.0.1 or later. For OpenNMS Meridian versions prior to 2018.1.19, update to version 2018.1.19 or later. For OpenNMS Meridian 2019 versions prior to 2019.1.7, update to version 2019.1.7 or later.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2020-12760

GHSA-853F-X27W-8R74

Affected Products

Activemq

Opennms Horizon

Opennms Meridian

References · 11

• https://issues.opennms.org/browse/NMS-12673 · Vendor Advisory
• https://opennms.com/en/blog/2020-04-29-opennms-horizon-26-0-1-luchador-released · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-12760 · Security Note
• https://osv.dev/vulnerability/CVE-2020-12760 · Vendor Advisory
• https://opennms.com/en/blog/2020-04-29-opennms-meridian-2019-1-6-europa-released · Vendor Advisory
• https://opennms.com/en/blog/2020-04-29-opennms-meridian-2018-1-18-wildfire-released · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-853f-x27w-8r74 · Vendor Advisory
• https://github.com/OpenNMS/opennms · Note
• https://github.com/OpenNMS/opennms/releases/tag/opennms-26.0.1-1 · Note
• https://github.com/OpenNMS/opennms/commit/e21fc14ce355533493da0db815bd81a66e291382 · Note
• https://github.com/OpenNMS/opennms/pull/2983 · Note