PT-2021-16860 · Opennms · Opennms Horizon+1
Published
2021-05-20
·
Updated
2021-05-26
·
CVE-2021-25930
CVSS v3.1
4.3
Medium
| Vector | AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
OpenNMS Horizon versions opennms-1-0-stable through opennms-27.1.0-1
OpenNMS Meridian versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1
OpenNMS Meridian versions meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1
Description
The issue is due to the lack of CSRF protection and no validation of an existing user name while renaming a user. As a result, privileges of the renamed user are being overwritten by the old user and the old user is being deleted from the user list.
Recommendations
For OpenNMS Horizon versions opennms-1-0-stable through opennms-27.1.0-1, consider disabling the user renaming feature until a patch is available.
For OpenNMS Meridian versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1, restrict access to the user management module to minimize the risk of exploitation.
For OpenNMS Meridian versions meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1, avoid using the user renaming feature until the issue is resolved.
Exploit
Fix
CSRF
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Opennms Horizon
Opennms Meridian