OpenNMS Horizon RCE via Unsafe Deserialization

HIGH 8.8CVE-2020-12760 · GHSA-853f-x27w-8r74 · Published 11/05/2020 · updated 17/06/2026

In short

CVE-2020-12760 is a HIGH (CVSS 8.8) vulnerability affecting org.opennms.core:org.opennms.core.daemon, opennms horizon (opennms), opennms meridian (opennms).
Chance of exploitation in the next 30 days (EPSS): 3.5%, higher than 89.0% of all vulnerabilities.
Fix: update to 26.0.1, 26.1.0, 2019.1.7, 2018.1.19 or later.

Package	Affected versions	Patched versions
org.opennms.core:org.opennms.core.daemon Maven	`< 26.0.1`	`26.0.1`
opennms horizon opennms	`< 26.1.0`	`26.1.0`
opennms meridian opennms	`≥ 2019, < 2019.1.7< 2018.1.19`	`2019.1.72018.1.19`

Description

An issue was discovered in OpenNMS Horizon before 26.0.1, and Meridian before 2018.1.19 and 2019 before 2019.1.7. The ActiveMQ channel configuration allowed for arbitrary deserialization of Java objects (aka ActiveMQ Minion payload deserialization), leading to remote code execution for any authenticated channel user regardless of its assigned permissions.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2020-12760 · ADVISORY
OpenNMS/opennms#2983 · WEB
OpenNMS/opennms commit e21fc14 · WEB
OpenNMS/opennms · PACKAGE
OpenNMS/opennms release opennms-26.0.1-1 · WEB
issues.opennms.org/browse/NMS-12673 · WEB
opennms.com/en/blog/2020-04-29-opennms-horizon-26-0-1-luchador-released · WEB
opennms.com/en/blog/2020-04-29-opennms-meridian-2018-1-18-wildfire-released · WEB
opennms.com/en/blog/2020-04-29-opennms-meridian-2019-1-6-europa-released · WEB
opennms.com/en/blog/2020-04-29-opennms-horizon-26-0-1-luchador-released · Release Notes
opennms.com/en/blog/2020-04-29-opennms-meridian-2018-1-18-wildfire-released

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free